SNOW-1825789 Secure token cache

lib/authentication/secure_storage/json_credential_manager.js

@@ -4,7 +4,7 @@ const fs = require('node:fs/promises');
 const Util = require('../../util');
 const os = require('os');
 const crypto = require('crypto');
-const { getSecureHandle } = require('../../file_util');
+const { getSecureHandle, closeHandle } = require('../../file_util');
 
 const defaultJsonTokenCachePaths = {
   'win32': ['AppData', 'Local', 'Snowflake', 'Caches'],
@@ -21,68 +21,66 @@ function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
 
   this.getTokenDirCandidates = function () {
     const candidates = [];
-    if (Util.exists(credentialCacheDir)) {
-      candidates.push({ folder: credentialCacheDir, subfolders: [] });
-    }
-    const sfTemp = process.env.SF_TEMPORARY_CREDENTIAL_CACHE_DIR;
-    if (Util.exists(sfTemp)) {
-      candidates.push({ folder: sfTemp, subfolders: [] });
-    }
-    const xdgCache = process.env.XDG_CACHE_HOME;
-    if (Util.exists(xdgCache) && process.platform === 'linux') {
-      candidates.push({ folder: xdgCache, subfolders: ['snowflake'] });
-    }
-    const home = process.env.HOME;
+    candidates.push({ folder: credentialCacheDir, subfolders: [] });
+
+    candidates.push({ folder: process.env.SF_TEMPORARY_CREDENTIAL_CACHE_DIR, subfolders: [] });
+
     switch (process.platform) {
     case 'win32':
-      candidates.push({ folder: os.homedir(), subfolders: module.exports.defaultJsonTokenCachePaths['win32'] });
+      candidates.push({ folder: os.homedir(), subfolders: defaultJsonTokenCachePaths['win32'] });
       break;
     case 'linux':
-      if (Util.exists(home)) {
-        candidates.push({ folder: home, subfolders: defaultJsonTokenCachePaths['linux'] });
-      }
+      candidates.push({ folder: process.env.XDG_CACHE_HOME, subfolders: ['snowflake'] });
+      candidates.push({ folder: process.env.HOME, subfolders: defaultJsonTokenCachePaths['linux'] });
       break;
     case 'darwin':
-      if (Util.exists(home)) {
-        candidates.push({ folder: home, subfolders: defaultJsonTokenCachePaths['darwin'] });
-      }
+      candidates.push({ folder: process.env.HOME, subfolders: defaultJsonTokenCachePaths['darwin'] });
     }
     return candidates;
   };
 
+  this.createCacheDir = async function (cacheDir) {
+    const options = { recursive: true };
+    if (process.platform !== 'win32') {
+      options.mode = 0o755;
+    }
+    await fs.mkdir(cacheDir, options);
+    if (process.platform !== 'win32') {
+      await fs.chmod(cacheDir, 0o700);
+    }
+  };
+
   this.tryTokenDir = async function (dir, subDirs) {
+    if (!Util.exists(dir)) {
+      return false;
+    }
     const cacheDir = path.join(dir, ...subDirs);
     try {
       const stat = await fs.stat(dir);
       if (!stat.isDirectory()) {
         Logger.getInstance().info(`Path ${dir} is not a directory`);
         return false;
       }
-      const cacheStat = await fs.lstat(cacheDir).catch((err) => {
+      const cacheStat = await fs.stat(cacheDir).catch(async (err) => {
         if (err.code !== 'ENOENT') {
           throw err;
         }
+        await this.createCacheDir(cacheDir);
+        return await fs.stat(cacheDir);
       });
-      if (!Util.exists(cacheStat)) {
-        const options = { recursive: true };
-        if (process.platform !== 'win32') {
-          options.mode = 0o700;
-        }
-        await fs.mkdir(cacheDir, options);
+      if (!cacheStat.isDirectory()) {
+        return false;
+      }
+      if (process.platform === 'win32') {
         return true;
-      } else {
-        if (!stat.isDirectory()) {
-          return false;
-        }
-        if (process.platform === 'win32') {
-          return true;
-        }
-        if ((cacheStat.mode & 0o777) === 0o700) {
-          return true;
-        }
+      }
+      if ((cacheStat.mode & 0o777) !== 0o700 && cacheStat.uid === os.userInfo().uid) {
         Logger.getInstance().warn(`Token cache directory ${cacheDir} has unsecure permissions.`);
-        return true;
       }
+      if (cacheStat.uid !== os.userInfo().uid) {
+        Logger.getInstance().warn(`Token cache directory ${cacheDir} has unsecure owner.`);
+      }
+      return true;
     } catch (err) {
       Logger.getInstance().warn(`The path location ${cacheDir} is invalid. Please check this location is accessible or existing`);
       return false;
@@ -95,26 +93,26 @@ function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
       const { folder: dir, subfolders: subDirs } = candidate;
       if (await this.tryTokenDir(dir, subDirs)) {
         return path.join(dir, ...subDirs);
-      } else {
-        Logger.getInstance().info(`${path.join(dir, ...subDirs)} is not a valid cache directory`);
       }
     }
     return null;
   };
 
-  this.getTokenFile = async function () {
+  this.getTokenFilePath = async function () {
     const tokenDir = await this.getTokenDir();
 
     if (!Util.exists(tokenDir)) {
       throw new Error(`Temporary credential cache directory is invalid, and the driver is unable to use the default location. 
       Please set 'credentialCacheDir' connection configuration option to enable the default credential manager.`);
     }
 
-    const tokenCacheFile = path.join(tokenDir, 'credential_cache_v1.json');
-    return [await getSecureHandle(tokenCacheFile, fs.constants.O_RDWR | fs.constants.O_CREAT, fs), tokenCacheFile];
+    return path.join(tokenDir, 'credential_cache_v1.json');
   };
 
   this.readJsonCredentialFile = async function (fileHandle) {
+    if (!Util.exists(fileHandle)) {
+      return null;
+    }
     try {
       const cred = await fileHandle.readFile('utf8');
       return JSON.parse(cred);
@@ -141,10 +139,8 @@ function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
 
   };
 
-
-  this.withFileLocked = async function (fun) {
-    const [fileHandle, file] = await this.getTokenFile();
-    const lckFile = file + '.lck';
+  this.lockFile = async function (filename) {
+    const lckFile = filename + '.lck';
     await this.removeStale(lckFile);
     let attempts = 1;
     let locked = false;
@@ -153,7 +149,7 @@ function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
       options.mode = 0o600;
     }
     while (attempts <= 10) {
-      Logger.getInstance().debug('Attempting to get a lock on file %s, attempt: %d', file, attempts);
+      Logger.getInstance().debug('Attempting to get a lock on file %s, attempt: %d', filename, attempts);
       attempts++;
       await fs.mkdir(lckFile, options).then(() => {
         locked = true;
@@ -164,18 +160,24 @@ function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
       await new Promise(resolve => setTimeout(resolve, 100));
     }
     if (!locked) {
-      if (Util.exists(fileHandle)) {
-        await fileHandle.close();
-      }
-      Logger.getInstance().warn('Could not acquire lock on cache file %s', file);
-      return null;
-    }
-    const res = await fun(fileHandle, file);
-    if (Util.exists(fileHandle)) {
-      await fileHandle.close();
+      Logger.getInstance().warn('Could not acquire lock on cache file %s', filename);
     }
+    return locked;
+  };
+
+  this.unlockFile = async function (filename) {
+    const lckFile = filename + '.lck';
     await fs.rmdir(lckFile);
-    return res;
+  };
+
+  this.withFileLocked = async function (fun) {
+    const filename = await this.getTokenFilePath();
+    if (await this.lockFile(filename)) {
+      const res = await fun(filename);
+      await this.unlockFile(filename);
+      return res;
+    }
+    return null;
   };
 
   this.write = async function (key, token) {
@@ -184,18 +186,20 @@ function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
     }
     const keyHash = this.hashKey(key);
 
-    await this.withFileLocked(async (fileHandle, filename) => {
+    await this.withFileLocked(async (filename) => {
+      const fileHandle = await getSecureHandle(filename, fs.constants.O_RDWR, fs);
       const jsonCredential = await this.readJsonCredentialFile(fileHandle) || {};
+      await closeHandle(fileHandle);
       if (!Util.exists(jsonCredential[tokenMapKey])) {
         jsonCredential[tokenMapKey] = {};
       }
       jsonCredential[tokenMapKey][keyHash] = token;
 
       try {
-        const flag = Util.exists(fileHandle) ? fs.constants.O_RDWR | fs.constants.O_CREAT : fs.constants.O_WRONLY;
+        const flag = Util.exists(fileHandle) ? fs.constants.O_WRONLY : fs.constants.O_RDWR | fs.constants.O_CREAT;
         const writeFileHandle = await getSecureHandle(filename, flag, fs);
         await writeFileHandle.writeFile(JSON.stringify(jsonCredential), { mode: 0o600 });
-        await writeFileHandle.close();
+        await closeHandle(writeFileHandle);
       } catch (err) {
         Logger.getInstance().warn(`Failed to write token data in ${filename}. Please check the permission or the file format of the token. ${err.message}`);
       }
@@ -209,8 +213,10 @@ function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
 
     const keyHash = this.hashKey(key);
 
-    return await this.withFileLocked(async (fileHandle) => {
+    return await this.withFileLocked(async (filename) => {
+      const fileHandle = await getSecureHandle(filename, fs.constants.O_RDWR, fs);
       const jsonCredential = await this.readJsonCredentialFile(fileHandle);
+      await closeHandle(fileHandle);
       if (!!jsonCredential && jsonCredential[tokenMapKey] && jsonCredential[tokenMapKey][keyHash]) {
         return jsonCredential[tokenMapKey][keyHash];
       } else {
@@ -226,16 +232,18 @@ function JsonCredentialManager(credentialCacheDir, timeoutMs = 60000) {
 
     const keyHash = this.hashKey(key);
 
-    await this.withFileLocked(async (fileHandle, filename) => {
+    await this.withFileLocked(async (filename) => {
+      const fileHandle = await getSecureHandle(filename, fs.constants.O_RDWR, fs);
       const jsonCredential = await this.readJsonCredentialFile(fileHandle);
+      await closeHandle(fileHandle);
 
       if (jsonCredential && jsonCredential[tokenMapKey] && jsonCredential[tokenMapKey][keyHash]) {
         try {
           jsonCredential[tokenMapKey][keyHash] = null;
-          const flag = Util.exists(fileHandle) ? fs.constants.O_RDWR | fs.constants.O_CREAT : fs.constants.O_WRONLY;
+          const flag = Util.exists(fileHandle) ? fs.constants.O_WRONLY : fs.constants.O_RDWR | fs.constants.O_CREAT;
           const writeFileHandle = await getSecureHandle(filename, flag, fs);
           await writeFileHandle.writeFile(JSON.stringify(jsonCredential), { mode: 0o600 });
-          await writeFileHandle.close();
+          await closeHandle(writeFileHandle);
         } catch (err) {
           Logger.getInstance().warn(`Failed to remove token data from the file in ${filename}. Please check the permission or the file format of the token. ${err.message}`);
         }

lib/file_util.js

@@ -202,11 +202,10 @@ exports.getSecureHandle = async function (filePath, flags, fsPromises) {
     const permission = mode & 0o777;
 
     //This should be 600 permission, which means the file permission has not been changed by others.
-    const octalPermissions = permission.toString(8);
-    if (octalPermissions === '600') {
+    if (permission === 0o600) {
       Logger.getInstance().debug(`Validated that the user has only read and write permission for file: ${filePath}, Permission: ${permission}`);
     } else {
-      throw new Error(`Invalid file permissions (${octalPermissions} for file ${filePath}). Make sure you have read and write permissions and other users do not have access to it. Please remove the file and re-run the driver.`);
+      throw new Error(`Invalid file permissions (${permission.toString(8)} for file ${filePath}). Make sure you have read and write permissions and other users do not have access to it. Please remove the file and re-run the driver.`);
     }
 
     const userInfo = os.userInfo();
@@ -226,6 +225,12 @@ exports.getSecureHandle = async function (filePath, flags, fsPromises) {
   }
 };
 
+exports.closeHandle = async function (fileHandle) {
+  if (fileHandle !== undefined && fileHandle !== null) {
+    await fileHandle.close();
+  }
+};
+
 /**
  * Checks if the provided file or directory permissions are correct.
  * @param filePath

test/unit/authentication/json_credential_manager_test.js

@@ -19,11 +19,8 @@ const pathFromHome = function () {
 };
 
 const assertCachePath = async function (credentialManager, path) {
-  const [fileHandle, filePath] = await credentialManager.getTokenFile();
+  const filePath = await credentialManager.getTokenFilePath();
   assert.strictEqual(filePath, path);
-  if (Util.exists(fileHandle)) {
-    fileHandle.close();
-  }
 };
 
 describe('Json credential manager basic test', function () {