Route Supabase credentials through Automic Vault

Author: mxcl

README.md

@@ -11,17 +11,13 @@ This fork currently adds the following behavior on top of upstream
 
 - An `isotope:supabase` package recipe that builds and signs both the
   Bun/TypeScript `supabase` launcher and the Go `supabase-go` helper.
-- Direct macOS Keychain access from the signed `supabase-go` binary instead
-  of `github.com/zalando/go-keyring` shelling out to `/usr/bin/security`, so
-  Keychain trust is attached to the Supabase executable.
-- A macOS-only `automicvault` Go build tag for the secure credential backend,
-  while default upstream builds continue to use `go-keyring`.
+- A macOS-only `automicvault` Go build tag that routes credential reads,
+  writes, and deletes through the Automic Vault XPC approval service.
 - A hazard detector for insecure Supabase CLI installs, including the
   plaintext fallback token at `~/.supabase/access-token` and Keychain ACLs
   that allow `/usr/bin/security` to read Supabase secrets.
-- A hidden `supabase-go av-migrate` command used by the Automic Vault isotope
-  migration hook to rewrite insecure Keychain items and move fallback access
-  tokens into the signed Supabase credential backend.
+- Migration of existing plaintext or legacy Keychain access tokens via
+  `av harden supabase`.
 - Test seams that keep the credential tests deterministic without touching the
   user's real Keychain.
 

apps/cli-go/cmd/av_keyring.go

@@ -0,0 +1,60 @@
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/supabase/cli/internal/utils/credentials"
+)
+
+var avKeyringCmd = &cobra.Command{
+	Use:    "av-keyring get|set|delete|delete-all",
+	Short:  "Read and write Supabase credentials through Automic Vault",
+	Hidden: true,
+	Args:   cobra.MinimumNArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		switch args[0] {
+		case "get":
+			if len(args) != 2 {
+				return fmt.Errorf("usage: supabase av-keyring get ACCOUNT")
+			}
+			value, err := credentials.StoreProvider.Get(args[1])
+			if err != nil {
+				return err
+			}
+			_, err = fmt.Fprint(cmd.OutOrStdout(), value)
+			return err
+		case "set":
+			if len(args) != 2 {
+				return fmt.Errorf("usage: supabase av-keyring set ACCOUNT")
+			}
+			value, err := io.ReadAll(os.Stdin)
+			if err != nil {
+				return err
+			}
+			return credentials.StoreProvider.Set(args[1], string(value))
+		case "delete":
+			if len(args) != 2 {
+				return fmt.Errorf("usage: supabase av-keyring delete ACCOUNT")
+			}
+			return credentials.StoreProvider.Delete(args[1])
+		case "delete-all":
+			if len(args) != 1 {
+				return fmt.Errorf("usage: supabase av-keyring delete-all")
+			}
+			return credentials.StoreProvider.DeleteAll()
+		default:
+			return fmt.Errorf("usage: supabase av-keyring get|set|delete|delete-all")
+		}
+	},
+}
+
+func isAVKeyringCommand(cmd *cobra.Command) bool {
+	return cmd != nil && cmd.CommandPath() == "supabase av-keyring"
+}
+
+func init() {
+	rootCmd.AddCommand(avKeyringCmd)
+}

apps/cli-go/cmd/av_migrate.go

@@ -101,7 +101,7 @@ var (
 			if err := utils.LoadProfile(ctx, fsys); err != nil {
 				return err
 			}
-			if isAVMigrateCommand(cmd) {
+			if isAVKeyringCommand(cmd) {
 				cmd.SetContext(ctx)
 				return nil
 			}
@@ -189,7 +189,7 @@ func Execute() {
 	if err != nil {
 		panic(err)
 	}
-	if isAVMigrateCommand(executedCmd) {
+	if isAVKeyringCommand(executedCmd) {
 		return
 	}
 	// Check upgrade last because --version flag is initialised after execute

apps/cli-go/cmd/root.go

@@ -5,7 +5,6 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
-	"strings"
 
 	"github.com/go-errors/errors"
 	"github.com/spf13/afero"
@@ -50,6 +49,9 @@ func loadAccessToken(fsys afero.Fs) (string, error) {
 		fmt.Fprintln(logger, "Using access token from credentials store...")
 		return accessToken, nil
 	}
+	if credentials.RequiresSecureStorage() {
+		return "", errors.New(ErrMissingToken)
+	}
 	// Fallback to token file
 	return fallbackLoadToken(fsys)
 }
@@ -77,6 +79,9 @@ func SaveAccessToken(accessToken string, fsys afero.Fs) error {
 	// Save to current profile
 	if err := credentials.StoreProvider.Set(CurrentProfile.Name, accessToken); err != nil {
 		fmt.Fprintln(GetDebugLogger(), err)
+		if credentials.RequiresSecureStorage() {
+			return errors.Errorf("failed to save access token to secure storage: %w", err)
+		}
 	} else {
 		return nil
 	}
@@ -98,72 +103,6 @@ func fallbackSaveToken(accessToken string, fsys afero.Fs) error {
 	return nil
 }
 
-func MigrateFallbackAccessToken(fsys afero.Fs) (bool, error) {
-	paths, err := fallbackAccessTokenMigrationPaths()
-	if err != nil {
-		return false, err
-	}
-
-	migrated := false
-	for _, path := range paths {
-		didMigrate, err := migrateFallbackAccessTokenPath(path, fsys)
-		if err != nil {
-			return migrated, err
-		}
-		migrated = migrated || didMigrate
-	}
-	return migrated, nil
-}
-
-func fallbackAccessTokenMigrationPaths() ([]string, error) {
-	var paths []string
-	supabaseHome := os.Getenv("SUPABASE_HOME")
-	defaultPath, err := getAccessTokenPath()
-	if err != nil {
-		if supabaseHome == "" {
-			return nil, err
-		}
-	} else {
-		paths = append(paths, defaultPath)
-	}
-	if supabaseHome != "" {
-		paths = append(paths, filepath.Join(supabaseHome, AccessTokenKey))
-	}
-
-	seen := make(map[string]struct{}, len(paths))
-	unique := paths[:0]
-	for _, path := range paths {
-		if _, ok := seen[path]; ok {
-			continue
-		}
-		seen[path] = struct{}{}
-		unique = append(unique, path)
-	}
-	return unique, nil
-}
-
-func migrateFallbackAccessTokenPath(path string, fsys afero.Fs) (bool, error) {
-	contents, err := afero.ReadFile(fsys, path)
-	if errors.Is(err, os.ErrNotExist) {
-		return false, nil
-	}
-	if err != nil {
-		return false, errors.Errorf("failed to read access token file for migration: %w", err)
-	}
-
-	accessToken := strings.TrimSpace(string(contents))
-	if !AccessTokenPattern.MatchString(accessToken) {
-		return false, errors.Errorf("refusing to migrate invalid access token file: %s", path)
-	}
-	if err := credentials.StoreProvider.Set(CurrentProfile.Name, accessToken); err != nil {
-		return false, errors.Errorf("failed to migrate access token file to keychain: %w", err)
-	}
-	if err := fsys.Remove(path); err != nil && !errors.Is(err, os.ErrNotExist) {
-		return false, errors.Errorf("failed to remove migrated access token file: %w", err)
-	}
-	return true, nil
-}
-
 func DeleteAccessToken(fsys afero.Fs) error {
 	// Always delete the fallback token file to handle legacy CLI
 	if err := fallbackDeleteToken(fsys); err != nil && !errors.Is(err, os.ErrNotExist) {