feat(dpapi): add secret store with import for dpapi (#1)

[Stephanya Casanova (savacano28)]

Proposed changes

• Adds import(): moves the token into a secret store safely, then deletes the clear-text copies.
• Inactive for now: no OS store is plugged in until feat(agent): encrypt the token with DPAPI on Windows (#1) #240, so the agent behaves like feat(agent): read the token through a secret store(#1) #239.
• Adds a bootstrap file (openaev-agent-token.bootstrap), read before the config.
• Token becomes optional in the config.
• Adds replace_file(): rewrites a file in one step, keeping its ACL / mode.

flowchart TD
  A[Token from bootstrap file<br/>or config] --> B[Write to store]
  B --> C{Read back OK?}
  C -- no --> X[Stop, delete nothing<br/>agent uses clear text]
  C -- yes --> D[Remove token from config]
  D --> E[Delete bootstrap file]

Loading

Testing Instructions

1. Same steps as feat(agent): read the token through a secret store(#1) #239: the agent must behave exactly the same.
2. Optional: create openaev-agent-token.bootstrap next to the exe with a valid token and remove the token from the config: agent stays online.

Related issues

• Depends on feat(agent): read the token through a secret store(#1) #239

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

Further comments

• Edge cases covered by tests: crash halfway (next start finishes), old config token never overwrites a newer one.
• Limitation: import() is only covered by unit tests until feat(agent): encrypt the token with DPAPI on Windows (#1) #240.
• Attention: the bootstrap file wins over the config, so the install folder must not be writable by non-admins.
• New deps: toml_edit, windows-sys.
• Not included: OS stores, installer changes.

[codecov]

Codecov Report

❌ Patch coverage is 73.33333% with 44 lines in your changes missing coverage. Please review.
✅ Project coverage is 45.51%. Comparing base (69723a1) to head (daa0080).

Files with missing lines	Patch %	Lines
src/secrets/mod.rs	24.13%	22 Missing ⚠️
src/config/settings.rs	10.00%	9 Missing ⚠️
src/secrets/import.rs	88.52%	7 Missing ⚠️
src/main.rs	0.00%	5 Missing ⚠️
src/secrets/replace.rs	97.67%	1 Missing ⚠️

❌ Your patch check has failed because the patch coverage (73.33%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@                    Coverage Diff                     @@
##           sca/agent-secret-store     #245      +/-   ##
==========================================================
+ Coverage                   38.91%   45.51%   +6.59%     
==========================================================
  Files                          14       16       +2     
  Lines                         740      892     +152     
==========================================================
+ Hits                          288      406     +118     
- Misses                        452      486      +34     

Flag	Coverage Δ
agent	45.51% <73.33%> (+6.59%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/secrets/config_store.rs	96.55% <100.00%> (+3.21%)	⬆️
src/secrets/replace.rs	97.67% <97.67%> (ø)
src/main.rs	0.00% <0.00%> (ø)
src/secrets/import.rs	88.52% <88.52%> (ø)
src/config/settings.rs	57.62% <10.00%> (-4.20%)	⬇️
src/secrets/mod.rs	26.66% <24.13%> (+26.66%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.