Authenticate from mounted secrets and stop passing the password to seaf-cli

The password could only be given through the PASSWORD variable, so Docker
Compose and Swarm secrets were unusable and the password sat in the container
environment.

PASSWORD_FILE and TOKEN_FILE read a secret from a mounted file. Only trailing
newlines are stripped, since secret files are usually written with one and a
password that silently carries it just fails to authenticate; everything else,
including surrounding spaces, belongs to the secret. Setting both a variable
and a file for one secret is rejected rather than resolved by precedence,
because the two are meant to be the same value and quietly picking one hides
the mistake until authentication fails.

The installed seaf-cli supports token authentication and ignores the password
when a token is given, so sync now passes -T instead of -p. The account
password no longer appears in any command line. The token does, because
seaf-cli accepts credentials only as arguments, but a token can be revoked on
the server. This is documented in the README.

Both secrets are masked before a command is logged.

Tests cover newline handling, empty and missing files, conflicting sources,
and that neither secret reaches the logs. Requests are now blocked in tests:
the client retries with backoff, so a test that reached the network appeared
to hang instead of failing.

dsc/client.py

@@ -12,8 +12,8 @@ from urllib3.util.retry import Retry
 import seafile
 
 from dsc import const
-from dsc.errors import DaemonError, DaemonTimeout
-from dsc.misc import create_dir, hide_password, user_cmd
+from dsc.errors import ConfigError, DaemonError, DaemonTimeout
+from dsc.misc import create_dir, hide_secrets, user_cmd
 
 _lg = logging.getLogger(__name__)
 
@@ -22,13 +22,16 @@ class SeafileClient:
     def __init__(self,
                  host: str,
                  user: str,
-                 passwd: str,
-                 app_dir: str = const.DEFAULT_APP_DIR):
+                 passwd: str = None,
+                 app_dir: str = const.DEFAULT_APP_DIR,
+                 token: str = None):
         self.user = user
         self.password = passwd
         self.app_dir = os.path.abspath(app_dir)
         self.rpc = seafile.RpcClient(os.path.join(self.app_dir, 'seafile-data', 'seafile.sock'))
-        self.__token = None
+        # A token supplied by the operator is used as is; otherwise one is
+        # fetched from the server with the password.
+        self.__token = token
 
         # determine server URL (assume HTTPS unless explicitly specified)
         if host.startswith('http://') or host.startswith('https://'):
@@ -86,6 +89,8 @@ class SeafileClient:
     @property
     def token(self):
         if self.__token is None:
+            if not self.password:
+                raise ConfigError("No password or token available to authenticate")
             url = f"{self.url}/api2/auth-token/"
             _lg.info("Fetching token: %s", url)
             r = self.session.post(url, data={"username": self.user, "password": self.password})
@@ -170,11 +175,14 @@ class SeafileClient:
             "-s", self.url,
             "-d", lib_dir,
             "-u", self.user,
-            "-p", self.password,
+            # The token, not the password: seaf-cli ignores the password when a
+            # token is given, and command arguments are visible to any process
+            # in the container. A token can also be revoked on the server.
+            "-T", self.token,
         ]
         _lg.info(
             "Syncing library %s into %s: %s", lib_id, lib_dir,
-            " ".join(hide_password(cmd, self.password)),
+            " ".join(hide_secrets(cmd, self.token, self.password)),
         )
         proc = self.__run(cmd, check=False)
         if proc.returncode != 0:

dsc/errors.py

@@ -5,6 +5,10 @@ class DscError(Exception):
     """Base class for failures that stop the client."""
 
 
+class ConfigError(DscError):
+    """The container was configured in a way that cannot be acted on."""
+
+
 class DaemonError(DscError):
     """A seaf-cli command failed."""
 

dsc/misc.py

@@ -55,9 +55,13 @@ def user_cmd(argv: list) -> list:
     return ["runuser", "-u", DEFAULT_USERNAME, "--"] + argv
 
 
-def hide_password(cmd: list, password: str) -> list:
+def hide_secrets(cmd: list, *secrets: str) -> list:
+    """Mask every given secret in a command before it is logged."""
     cmd = cmd.copy()
-    for i, arg in enumerate(cmd):
-        if password in arg:
-            cmd[i] = arg.replace(password, "********")
+    for secret in secrets:
+        if not secret:
+            continue
+        for i, arg in enumerate(cmd):
+            if secret in arg:
+                cmd[i] = arg.replace(secret, "********")
     return cmd

dsc/secrets.py

@@ -0,0 +1,57 @@
+"""Read secrets from a variable or a mounted file.
+
+Docker Compose and Swarm secrets arrive as files under /run/secrets, which
+keeps them out of the environment. Nothing here ever puts a secret value into
+a message: an error about a secret must not leak the secret.
+"""
+
+import logging
+import os
+
+from dsc.errors import ConfigError
+
+_lg = logging.getLogger(__name__)
+
+
+def read_secret_file(path: str) -> str:
+    """
+    Return the secret stored in ``path``.
+
+    Only trailing newlines are removed. Secret files are commonly written with
+    one, and a password that silently carries it just fails to authenticate.
+    Everything else, including surrounding spaces, is part of the secret.
+    """
+    if not os.path.isfile(path):
+        raise ConfigError(f"Secret file {path} does not exist or is not a file")
+
+    try:
+        with open(path, "r") as f:
+            secret = f.read()
+    except OSError as err:
+        raise ConfigError(f"Cannot read secret file {path}: {err.strerror}")
+
+    secret = secret.rstrip("\r\n")
+    if not secret:
+        raise ConfigError(f"Secret file {path} is empty")
+    return secret
+
+
+def resolve_secret(name: str, value: str, file_path: str) -> str:
+    """
+    Return the secret named ``name``, from either the variable or the file.
+
+    Supplying both is rejected rather than resolved by precedence: the two
+    values are usually meant to be the same, and quietly picking one hides a
+    misconfiguration until authentication fails.
+    """
+    file_name = f"{name}_FILE"
+    if value and file_path:
+        raise ConfigError(
+            f"{name} and {file_name} are both set; use exactly one of them"
+        )
+
+    if file_path:
+        _lg.info("Reading %s from %s", name, file_path)
+        return read_secret_file(file_path)
+
+    return value or None