feat: add chunked storage

[phoenix-ru]

Problem

This fixes the windows SSO bug where users who tried signing in via SSO received the following error:

Error: Error Value of 'password encoded as UTF-16' is longer than the platform limit of 2560 chars

After some research, it turns out Windows CREDENTIALW service has CredentialBlobSize limit of 5*512 bytes.

Since SSO mode can take up to 5000 characters in keyring storage, this greatly exceeds the limits enforced by the platform.

Solution

To solve this, the normal payload is split to chunks which are simply fragments of the original credentials JSON. So the stringified {"mode":"sso","accessToken":...} is split into chunks of up to 1024 characters (2048 bytes in UTF-16) and the parent entry becomes:

z.object({
  mode: z.literal(StorageMode.Chunked),
  chunkCount: z.int().positive(),
  chunkId: z.string().min(1),
  checksum: z.string(),
})

The fields help later reconstruct/modify/delete the original saved credentials:

• chunkCount specifies how many chunks need to be read;
• checksum is the SHA-256 checksum of the concatenation of all chunks - if any of the chunks are modified, the checksum would mismatch and invalidate the credentials;
• chunkId is a unique identifier shared by the chunks which facilitates atomic re-writes of all chunks: first the new chunks are written with a new chunkId, then the parent entry (manifest) is updated, then the old chunks are deleted.

The chunks stored in the keyring have the following label:

`aws-ssm-secrets/v2/chunk/${chunkId}/${index}`

[phoenix-ru]

Was able to test this on an actual Windows installation:

diff --git a/src/keyring.ts b/src/keyring.ts
index 6b91978..016ae0d 100644
--- a/src/keyring.ts
+++ b/src/keyring.ts
@@ -129,6 +129,7 @@ function parseCurrentCredentials(jsonString: string, allowChunked: boolean): Pro
   const credentials = credentialsParseResult.data

   if (credentials.mode === StorageMode.Chunked && allowChunked) {
+    console.log('Reading chunked credentials', credentials)
     return readChunkedCredentials(credentials)
   }
   else if (credentials.mode === StorageMode.Chunked) {

Output:

Reading chunked credentials {
  mode: 'chunked',
  chunkCount: 5,
  chunkId: '07922b36',
  checksum: '07922b36712775226a09dedcf07dcf195a7a8047bcf06567b049dd826d7a535e'
}