feat: add secret_service, pass, and credential_manager resolvers (#152)

Author: MattDevy

.mega-linter.yml

@@ -1,5 +1,5 @@
 ENABLE_LINTERS:
-  - TYPESCRIPT_ESLINT
+  - TYPESCRIPT_ES
   - YAML_YAMLLINT
   - ACTION_ACTIONLINT
   - DOCKERFILE_HADOLINT
@@ -15,19 +15,25 @@ SARIF_REPORTER: false
 FLAVOR_SUGGESTIONS: false
 REPORTERS_MARKDOWN_TYPE: simple
 
-# ESLint 10 compat: install project deps, use local eslint binary
+# Install project deps (eslint, typescript-eslint) so eslint.config.js resolves.
+# NODE_ENV=production in the container skips devDependencies by default.
 PRE_COMMANDS:
-  - command: "npm ci --ignore-scripts"
+  - command: "NODE_ENV=development npm ci --ignore-scripts"
     cwd: "workspace"
 
-TYPESCRIPT_ESLINT_CLI_EXECUTABLE: "./node_modules/.bin/eslint"
-TYPESCRIPT_ESLINT_CONFIG_FILE: eslint.config.js
+# Use project's ESLint 10 (flat config, --no-eslintrc removed in v9+)
+TYPESCRIPT_ES_CLI_EXECUTABLE:
+  - "node"
+  - "node_modules/.bin/eslint"
+TYPESCRIPT_ES_CONFIG_FILE: eslint.config.js
+TYPESCRIPT_ES_COMMAND_REMOVE_ARGUMENTS:
+  - "--no-eslintrc"
 
 # Global exclusions
 FILTER_REGEX_EXCLUDE: "(node_modules/|dist/|build/|\\.git/)"
 
 # Skip generated code for ESLint (39k lines of schemas + 2k lines of cloud APIs)
-TYPESCRIPT_ESLINT_FILTER_REGEX_EXCLUDE: "(src/es/apis/schemas/|src/cloud/apis/)"
+TYPESCRIPT_ES_FILTER_REGEX_EXCLUDE: "(src/es/apis/schemas/|src/cloud/apis/)"
 
 # yamllint: skip test fixtures (custom multi-doc YAML DSL)
 YAML_YAMLLINT_CONFIG_FILE: .yamllint.yml

README.md

@@ -106,6 +106,41 @@ auth:
 
 To store a value: `security add-generic-password -s elastic-cli -a api-key -w`
 
+#### `secret_service` - freedesktop Secret Service (Linux only)
+
+Reads a secret from GNOME Keyring or KWallet via `secret-tool`. Uses the same
+`service/account` format as `keychain`.
+
+```yaml
+auth:
+  api_key: $(secret_service:elastic-cli/api-key)
+```
+
+To store a value: `secret-tool store --label='Elastic API Key' service elastic-cli account api-key`
+
+#### `pass` - standard Unix password manager (cross-platform)
+
+Reads the first line from `pass show`. Works on Linux, macOS, and Windows (WSL).
+
+```yaml
+auth:
+  api_key: $(pass:elastic/api-key)
+```
+
+To store a value: `pass insert elastic/api-key`
+
+#### `credential_manager` - Windows Credential Manager (Windows only)
+
+Reads a credential from Windows Credential Manager using the `service/account`
+format. Requires the `CredentialManager` PowerShell module.
+
+```yaml
+auth:
+  api_key: $(credential_manager:elastic-cli/api-key)
+```
+
+To store a value: `New-StoredCredential -Target elastic-cli/api-key -UserName _ -Password <key>`
+
 Expressions can appear in any string field, including URLs:
 
 ```yaml

src/config/resolvers.ts

@@ -101,6 +101,11 @@ function shellEscape (value: string): string {
   return "'" + value.replace(/'/g, "'\\''") + "'"
 }
 
+function psEncodedCommand (expression: string): string {
+  const utf16le = Buffer.from(expression, 'utf16le')
+  return `powershell -NoProfile -NonInteractive -EncodedCommand ${utf16le.toString('base64')}`
+}
+
 const MAX_FILE_SIZE = 64 * 1024 // 64 KB
 
 function fileResolver (params: string): string {
@@ -137,42 +142,136 @@ function cmdResolver (params: string): string {
   }
 }
 
+const PRINTABLE_ASCII_RE = /^[\x20-\x7e]+$/
+
+function parseServiceAccount (params: string, resolverName: string): { service: string; account: string } {
+  if (!PRINTABLE_ASCII_RE.test(params)) {
+    throw new Error(
+      `Invalid ${resolverName} parameter "${params}": contains non-printable characters`
+    )
+  }
+
+  const slashIndex = params.indexOf('/')
+  if (slashIndex === -1 || slashIndex === 0 || slashIndex === params.length - 1) {
+    throw new Error(
+      `Invalid ${resolverName} parameter "${params}": expected format "service/account" ` +
+      `(e.g., "elastic-cli/api-key")`
+    )
+  }
+
+  return { service: params.slice(0, slashIndex), account: params.slice(slashIndex + 1) }
+}
+
 function keychainResolver (params: string): string {
   if (_platform !== 'darwin') {
     throw new Error(
       `The keychain resolver is only supported on macOS (current platform: ${_platform})`
     )
   }
 
-  if (!/^[\x20-\x7e]+$/.test(params)) {
+  const { service, account } = parseServiceAccount(params, 'keychain')
+
+  try {
+    return _execSync(
+      `security find-generic-password -s ${shellEscape(service)} -a ${shellEscape(account)} -w`,
+      execOpts(5_000)
+    ).trimEnd()
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
     throw new Error(
-      `Invalid keychain parameter "${params}": contains non-printable characters`
+      `Keychain lookup failed for service="${service}", account="${account}": ${message}`,
+      { cause: err }
     )
   }
+}
 
-  const slashIndex = params.indexOf('/')
-  if (slashIndex === -1 || slashIndex === 0 || slashIndex === params.length - 1) {
+function secretServiceResolver (params: string): string {
+  if (_platform !== 'linux') {
     throw new Error(
-      `Invalid keychain parameter "${params}": expected format "service/account" ` +
-      `(e.g., "elastic-cli/api-key")`
+      `The secret_service resolver is only supported on Linux (current platform: ${_platform})`
     )
   }
 
-  const service = params.slice(0, slashIndex)
-  const account = params.slice(slashIndex + 1)
+  const { service, account } = parseServiceAccount(params, 'secret_service')
 
   try {
     return _execSync(
-      `security find-generic-password -s ${shellEscape(service)} -a ${shellEscape(account)} -w`,
+      `secret-tool lookup service ${shellEscape(service)} account ${shellEscape(account)}`,
       execOpts(5_000)
     ).trimEnd()
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err)
     throw new Error(
-      `Keychain lookup failed for service="${service}", account="${account}": ${message}`,
+      `Secret Service lookup failed for service="${service}", account="${account}": ${message}`,
+      { cause: err }
+    )
+  }
+}
+
+function passResolver (params: string): string {
+  const path = params.trim()
+  if (path === '') {
+    throw new Error('Invalid pass parameter: path must not be empty')
+  }
+  if (!PRINTABLE_ASCII_RE.test(path)) {
+    throw new Error(
+      `Invalid pass parameter "${path}": contains non-printable characters`
+    )
+  }
+
+  let output: string
+  try {
+    output = _execSync(
+      `pass show ${shellEscape(path)}`,
+      execOpts(5_000)
+    ).trimEnd()
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    throw new Error(
+      `pass lookup failed for "${path}": ${message}`,
       { cause: err }
     )
   }
+
+  const nl = output.indexOf('\n')
+  const firstLine = nl === -1 ? output : output.slice(0, nl)
+  if (firstLine === '') {
+    throw new Error(`pass returned empty output for "${path}"`)
+  }
+  return firstLine
+}
+
+function credentialManagerResolver (params: string): string {
+  if (_platform !== 'win32') {
+    throw new Error(
+      `The credential_manager resolver is only supported on Windows (current platform: ${_platform})`
+    )
+  }
+
+  const { service, account } = parseServiceAccount(params, 'credential_manager')
+  const target = `${service}/${account}`
+  const expression = `(Get-StoredCredential -Target '${target.replace(/'/g, "''")}').GetNetworkCredential().Password`
+
+  let result: string
+  try {
+    result = _execSync(
+      psEncodedCommand(expression),
+      execOpts(10_000)
+    ).trimEnd()
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    throw new Error(
+      `Credential Manager lookup failed for service="${service}", account="${account}": ${message}`,
+      { cause: err }
+    )
+  }
+
+  if (result === '') {
+    throw new Error(
+      `Credential Manager returned empty password for service="${service}", account="${account}"`
+    )
+  }
+  return result
 }
 
 // ---------------------------------------------------------------------------
@@ -184,6 +283,9 @@ function registerBuiltins (): void {
   registerResolver('env', envResolver)
   registerResolver('cmd', cmdResolver)
   registerResolver('keychain', keychainResolver)
+  registerResolver('secret_service', secretServiceResolver)
+  registerResolver('pass', passResolver)
+  registerResolver('credential_manager', credentialManagerResolver)
 }
 
 registerBuiltins()