Treat an invalid error on credential removal as a missing entry on Windows

This commit is contained in:
Zanie Blue 2025-08-27 14:36:26 -05:00
parent 960714d4d6
commit 396dc06799
3 changed files with 13 additions and 5 deletions

1
Cargo.lock generated
View File

@ -5838,6 +5838,7 @@ dependencies = [
"secret-service", "secret-service",
"security-framework", "security-framework",
"tokio", "tokio",
"tracing",
"windows-sys 0.59.0", "windows-sys 0.59.0",
"zeroize", "zeroize",
] ]

View File

@ -23,6 +23,7 @@ windows-native = ["dep:windows-sys", "dep:byteorder"]
[dependencies] [dependencies]
async-trait = { workspace = true } async-trait = { workspace = true }
tokio = { workspace = true } tokio = { workspace = true }
tracing = { workspace = true }
[target.'cfg(target_os = "macos")'.dependencies] [target.'cfg(target_os = "macos")'.dependencies]
security-framework = { version = "3", optional = true } security-framework = { version = "3", optional = true }

View File

@ -44,9 +44,10 @@ use byteorder::{ByteOrder, LittleEndian};
use std::collections::HashMap; use std::collections::HashMap;
use std::iter::once; use std::iter::once;
use std::str; use std::str;
use tracing::debug;
use windows_sys::Win32::Foundation::{ use windows_sys::Win32::Foundation::{
ERROR_BAD_USERNAME, ERROR_ENVVAR_NOT_FOUND, ERROR_INVALID_FLAGS, ERROR_INVALID_PARAMETER, ERROR_BAD_USERNAME, ERROR_ENVVAR_NOT_FOUND, ERROR_INVALID_FLAGS, ERROR_INVALID_HANDLE,
ERROR_NO_SUCH_LOGON_SESSION, ERROR_NOT_FOUND, FILETIME, GetLastError, ERROR_INVALID_PARAMETER, ERROR_NO_SUCH_LOGON_SESSION, ERROR_NOT_FOUND, FILETIME, GetLastError,
}; };
use windows_sys::Win32::Security::Credentials::{ use windows_sys::Win32::Security::Credentials::{
CRED_FLAGS, CRED_MAX_CREDENTIAL_BLOB_SIZE, CRED_MAX_GENERIC_TARGET_NAME_LENGTH, CRED_FLAGS, CRED_MAX_CREDENTIAL_BLOB_SIZE, CRED_MAX_GENERIC_TARGET_NAME_LENGTH,
@ -500,9 +501,14 @@ pub fn decode_error() -> ErrorCode {
// SAFETY: Calling Windows API // SAFETY: Calling Windows API
match unsafe { GetLastError() } { match unsafe { GetLastError() } {
ERROR_NOT_FOUND => ErrorCode::NoEntry, ERROR_NOT_FOUND => ErrorCode::NoEntry,
// N.B. It's not clear why `ERROR_ENVVAR_NOT_FOUND` would be returned rather than // N.B. It's not clear why `ERROR_ENVVAR_NOT_FOUND` or `ERROR_INVALID_HANDLE` would be
// `ERROR_NOT_FOUND`, but this was encountered on a Windows CI machine. // returned rather than `ERROR_NOT_FOUND`, but these were encountered on Windows CI machines.
ERROR_ENVVAR_NOT_FOUND => ErrorCode::NoEntry, err @ (ERROR_ENVVAR_NOT_FOUND | ERROR_INVALID_HANDLE) => {
debug!(
"Windows credential operation failed with error code {err}, treating it as a missing credential"
);
ErrorCode::NoEntry
}
ERROR_NO_SUCH_LOGON_SESSION => { ERROR_NO_SUCH_LOGON_SESSION => {
ErrorCode::NoStorageAccess(wrap(ERROR_NO_SUCH_LOGON_SESSION)) ErrorCode::NoStorageAccess(wrap(ERROR_NO_SUCH_LOGON_SESSION))
} }