Secure token storage

// macOS Keychain helper. Swift6/macOS13+, Foundation/Security. No dependency.
// Run: keychain put|get|delete ITEM; put reads secret from stdin, get writes stdout.
// Expected exit0 on success; generic error on failure. Never pass tokens in argv.
import Foundation
import Security
let service = "com.kdpika.documentation.storage-example"
func query(_ item: String) -> [String: Any] {
    [kSecClass as String:kSecClassGenericPassword, kSecAttrService as String:service,
     kSecAttrAccount as String:item]
}
do {
    guard CommandLine.arguments.count == 3 else { throw NSError(domain: "Usage",code:1) }
    let action = CommandLine.arguments[1], item = CommandLine.arguments[2]
    guard item.range(of: #"^[A-Za-z0-9._-]{8,128}$"#,options:.regularExpression) != nil else { throw NSError(domain:"Item",code:1) }
    let base = query(item); var status: OSStatus
    switch action {
    case "put":
        let data = FileHandle.standardInput.readData(ofLength: 16385)
        guard !data.isEmpty && data.count <= 16384 else { throw NSError(domain:"Size",code:1) }
        status = SecItemUpdate(base as CFDictionary,[kSecValueData as String:data] as CFDictionary)
        if status == errSecItemNotFound {
            var add = base; add[kSecValueData as String] = data
            add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
            status = SecItemAdd(add as CFDictionary,nil)
        }
    case "get":
        var request = base; request[kSecReturnData as String] = true; request[kSecMatchLimit as String] = kSecMatchLimitOne
        var result: CFTypeRef?; status = SecItemCopyMatching(request as CFDictionary,&result)
        if status == errSecSuccess, let data = result as? Data { FileHandle.standardOutput.write(data) }
    case "delete":
        status = SecItemDelete(base as CFDictionary)
        if status == errSecItemNotFound { status = errSecSuccess }
    default: throw NSError(domain:"Usage",code:1)
    }
    guard status == errSecSuccess else { throw NSError(domain:"Keychain",code:Int(status)) }
} catch {
    FileHandle.standardError.write(Data("Secure storage is unavailable.\n".utf8)); exit(1)
}

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net7.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="7.0.0" />
  </ItemGroup>
</Project>

// Windows CurrentUser DPAPI helper. .NET7+, ProtectedData7.0.0; Windows only.
// Run built Dpapi.dll put|get|delete. put reads stdin; get writes raw secret stdout.
// Exit0 on success; unavailable/error exits1. This is not an SDK storage adapter.
using System.Security.Cryptography;
try {
    if (!OperatingSystem.IsWindows() || args.Length != 1) throw new PlatformNotSupportedException();
    var directory = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),"KDPikaSecureStorageExample");
    var path = Path.Combine(directory,"activation-token.dpapi");
    switch (args[0]) {
        case "put":
            using (var input = Console.OpenStandardInput()) {
                var clear = new byte[16385]; var count = 0;
                while (count < clear.Length) { var n = input.Read(clear,count,clear.Length-count); if(n==0) break; count+=n; }
                if (count == 0 || count > 16384) throw new ArgumentException();
                var protectedBytes = ProtectedData.Protect(clear.AsSpan(0,count).ToArray(),null,DataProtectionScope.CurrentUser);
                CryptographicOperations.ZeroMemory(clear);
                Directory.CreateDirectory(directory);
                var temporary = path + "." + Guid.NewGuid().ToString("N");
                File.WriteAllBytes(temporary,protectedBytes); File.Move(temporary,path,true);
            }
            break;
        case "get":
            var secret = ProtectedData.Unprotect(File.ReadAllBytes(path),null,DataProtectionScope.CurrentUser);
            using(var output=Console.OpenStandardOutput()) output.Write(secret);
            CryptographicOperations.ZeroMemory(secret); break;
        case "delete": File.Delete(path); break;
        default: throw new ArgumentException();
    }
    return 0;
} catch { Console.Error.WriteLine("Secure storage is unavailable."); return 1; }

"""Linux Secret Service helper. Python3.9+, libsecret secret-tool, unlocked vault.
Run: python3 secret_service.py put|get|delete ITEM. put reads stdin; get writes stdout.
Exit0 on success; no plaintext fallback. Never pass the token in an argument.
"""
import re
import subprocess
import sys

def operate(action, item, value=None):
    if not re.fullmatch(r'[A-Za-z0-9._-]{8,128}', item):
        raise ValueError('Invalid item')
    attributes = ['application', 'com.kdpika.documentation.storage-example', 'installation', item]
    if action == 'put':
        if not isinstance(value, bytes) or not 0 < len(value) <= 16384:
            raise ValueError('Invalid secret size')
        command = ['secret-tool', 'store', '--label=KDPika activation token'] + attributes
    elif action == 'get': command = ['secret-tool', 'lookup'] + attributes
    elif action == 'delete': command = ['secret-tool', 'clear'] + attributes
    else: raise ValueError('Unknown action')
    result = subprocess.run(command, input=value if action == 'put' else None,
                            capture_output=True, timeout=30, check=True)
    return result.stdout.rstrip(b'\n') if action == 'get' else b''

if __name__ == '__main__':
    try:
        if len(sys.argv) != 3: raise ValueError('Expected action and item')
        action, item = sys.argv[1:]
        value = sys.stdin.buffer.read(16385) if action == 'put' else None
        sys.stdout.buffer.write(operate(action,item,value))
    except Exception:
        print('Secure storage is unavailable.',file=sys.stderr)
        sys.exit(1)

// Electron main-process safeStorage helper. Electron>=28, Node18+, built-in fs.
// Pass Electron's safeStorage after app.whenReady(), then put/get/remove.
// Reject unavailable encryption and Linux basic_text; never plaintext fallback.
import fs from 'node:fs';
import path from 'node:path';
import crypto from 'node:crypto';
export function tokenStore(safeStorage, directory, platform = process.platform) {
  const file = path.join(directory,'activation-token.encrypted');
  function requireVault() {
    if (!safeStorage.isEncryptionAvailable() ||
        (platform === 'linux' && (!safeStorage.getSelectedStorageBackend || safeStorage.getSelectedStorageBackend() === 'basic_text'))) {
      throw new Error('Secure storage is unavailable.');
    }
  }
  return {
    put(token) {
      requireVault(); if (typeof token !== 'string' || !token || Buffer.byteLength(token)>16384) throw Error('Invalid token size');
      fs.mkdirSync(directory,{recursive:true,mode:0o700});
      const encrypted=safeStorage.encryptString(token), temporary=file+'.'+crypto.randomUUID();
      fs.writeFileSync(temporary,encrypted,{mode:0o600,flag:'wx'}); fs.renameSync(temporary,file);
    },
    get() { requireVault(); return safeStorage.decryptString(fs.readFileSync(file)); },
    remove() { if(fs.existsSync(file)) fs.unlinkSync(file); }
  };
}