45 lines
1.8 KiB
Python
45 lines
1.8 KiB
Python
|
"""可信程序内部使用的系统凭据适配器，不提供明文输出 CLI。"""
|
||
|
|
from __future__ import annotations
|
||
|
|
import importlib
|
||
|
|
import sys
|
||
|
|
|
||
|
|
SERVICE = 'org.oiloil.skill-credentials'
|
||
|
|
|
||
|
|
def backend():
|
||
|
|
"""显式选择系统后端，拒绝自动退回明文或临时存储。"""
|
||
|
|
target = {
|
||
|
|
'darwin': ('keyring.backends.macOS', 'Keyring'),
|
||
|
|
'win32': ('keyring.backends.Windows', 'WinVaultKeyring'),
|
||
|
|
'linux': ('keyring.backends.SecretService', 'Keyring'),
|
||
|
|
}.get(sys.platform)
|
||
|
|
if target is None:
|
||
|
|
raise RuntimeError('当前系统未实现安全凭据后端；请使用运行时环境变量')
|
||
|
|
try:
|
||
|
|
result = getattr(importlib.import_module(target[0]), target[1])()
|
||
|
|
if result.priority <= 0:
|
||
|
|
raise RuntimeError('后端不可用')
|
||
|
|
return result
|
||
|
|
except Exception:
|
||
|
|
raise RuntimeError('系统凭据库不可用；请检查 keyring 依赖与系统解锁状态，或使用运行时环境变量') from None
|
||
|
|
|
||
|
|
def read(reference: str) -> str:
|
||
|
|
try:
|
||
|
|
return backend().get_password(SERVICE, reference) or ''
|
||
|
|
except Exception:
|
||
|
|
raise RuntimeError('无法读取系统凭据；不会降级保存明文') from None
|
||
|
|
|
||
|
|
def save(reference: str, secret: str) -> None:
|
||
|
|
if not secret or '\n' in secret or '\r' in secret:
|
||
|
|
raise ValueError('凭据必须是非空单行文本')
|
||
|
|
try:
|
||
|
|
backend().set_password(SERVICE, reference, secret)
|
||
|
|
except Exception:
|
||
|
|
raise RuntimeError('系统凭据保存失败；原配置未被改为明文') from None
|
||
|
|
|
||
|
|
def delete(reference: str) -> None:
|
||
|
|
try:
|
||
|
|
store = backend()
|
||
|
|
if store.get_password(SERVICE, reference) is not None:
|
||
|
|
store.delete_password(SERVICE, reference)
|
||
|
|
except Exception:
|
||
|
|
raise RuntimeError('系统凭据删除失败；请检查后端状态') from None
|