Merge pull request #2 from cosmos/feat/access_denied_error

Feat/access denied error

.github/workflows/lint.yml

@@ -4,7 +4,7 @@ jobs:
   golangci:
     strategy:
       matrix:
-        go-version: [1.15.x]
+        go-version: [1.17.x]
         os: [macos-latest, windows-latest, ubuntu-latest]
     name: lint
     runs-on: ${{ matrix.os }}
@@ -16,4 +16,5 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v2
         with:
-          version: v1.44.2
+          version: v1.47.3
+          args: --timeout=5m

.gitignore

@@ -1 +1,2 @@
 .vagrant
+.idea

file.go

@@ -3,7 +3,6 @@ package keyring
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"time"
@@ -75,7 +74,7 @@ func (k *fileKeyring) Get(key string) (Item, error) {
 		return Item{}, err
 	}
 
-	bytes, err := ioutil.ReadFile(filename)
+	bytes, err := os.ReadFile(filename)
 	if os.IsNotExist(err) {
 		return Item{}, ErrKeyNotFound
 	} else if err != nil {
@@ -144,7 +143,7 @@ func (k *fileKeyring) Set(i Item) error {
 	if err != nil {
 		return err
 	}
-	return ioutil.WriteFile(filename, []byte(token), 0600)
+	return os.WriteFile(filename, []byte(token), 0600)
 }
 
 func (k *fileKeyring) filename(key string) (string, error) {
@@ -162,7 +161,7 @@ func (k *fileKeyring) Remove(key string) error {
 		return err
 	}
 
-	return os.Remove(filename)
+	return os.RemoveAll(filename)
 }
 
 func (k *fileKeyring) Keys() ([]string, error) {
@@ -172,7 +171,7 @@ func (k *fileKeyring) Keys() ([]string, error) {
 	}
 
 	var keys = []string{}
-	files, _ := ioutil.ReadDir(dir)
+	files, _ := os.ReadDir(dir)
 	for _, f := range files {
 		keys = append(keys, filenameUnescape(f.Name()))
 	}

keychain.go

@@ -3,13 +3,26 @@
 
 package keyring
 
+/*
+#cgo LDFLAGS: -framework CoreFoundation -framework Security
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <Security/Security.h>
+*/
+import "C"
 import (
 	"errors"
 	"fmt"
 
 	gokeychain "github.com/99designs/go-keychain"
 )
 
+// Extended error list that gokeychain doesn't catch
+var (
+	// ErrorUserCanceled corresponds to errSecUserCanceled result code
+	ErrorUserCanceled = gokeychain.Error(C.errSecUserCanceled)
+)
+
 type keychain struct {
 	path    string
 	service string
@@ -58,14 +71,23 @@ func (k *keychain) Get(key string) (Item, error) {
 
 	debugf("Querying keychain for service=%q, account=%q, keychain=%q", k.service, key, k.path)
 	results, err := gokeychain.QueryItem(query)
-	if err == gokeychain.ErrorItemNotFound || len(results) == 0 {
-		debugf("No results found")
-		return Item{}, ErrKeyNotFound
+	if err != nil {
+		switch err {
+		case ErrorUserCanceled:
+			debugf("Keychain access denied")
+			return Item{}, ErrAccessDenied
+		case gokeychain.ErrorItemNotFound:
+			debugf("Item not found in the keyring")
+			return Item{}, ErrKeyNotFound
+		default:
+			debugf("Error: %#v", err)
+			return Item{}, err
+		}
 	}
 
-	if err != nil {
-		debugf("Error: %#v", err)
-		return Item{}, err
+	if len(results) == 0 {
+		debugf("No results found")
+		return Item{}, ErrKeyNotFound
 	}
 
 	item := Item{

keyring.go

@@ -122,6 +122,9 @@ var ErrMetadataNeedsCredentials = errors.New("The keyring backend requires crede
 // ErrMetadataNotSupported is returned when Metadata is not available for the backend.
 var ErrMetadataNotSupported = errors.New("The keyring backend does not support metadata access")
 
+// ErrAccessDenied is returned by Keyring Get when access to Keychain is denied by the user
+var ErrAccessDenied = errors.New("Keyring backend access denied by user")
+
 var (
 	// Debug specifies whether to print debugging output.
 	Debug bool

pass_test.go

@@ -6,11 +6,11 @@ package keyring
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"reflect"
+	"syscall"
 	"testing"
 )
 
@@ -34,7 +34,7 @@ func setup(t *testing.T) (*passKeyring, func(t *testing.T)) {
 	}
 
 	// the default temp directory can't be used because gpg-agent complains with "socket name too long"
-	tmpdir, err := ioutil.TempDir("/tmp", "keyring-pass-test-*")
+	tmpdir, err := os.MkdirTemp("/tmp", "keyring-pass-test-*")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -224,7 +224,7 @@ func TestPassKeyringKeysWithSymlink(t *testing.T) {
 	}
 
 	s := filepath.Join(t.TempDir(), "newsymlink")
-	err := os.Symlink(k.dir, s)
+	err := syscall.Symlink(k.dir, s)
 	if err != nil {
 		t.Fatal(err)
 	}