chore: import upstream snapshot with attribution

2026-07-13 12:49:17 +08:00
commit 7243d5823b
2201 changed files with 257291 additions and 0 deletions
@@ -0,0 +1,65 @@
+using UnityEngine;
+
+namespace MCPForUnity.Editor.Security
+{
+    /// <summary>
+    /// Entry point for at-rest provider key storage. Selects the best OS secure store for
+    /// the current platform and layers the read-only environment-variable override on top.
+    /// Keys never transit the MCP bridge; only the C# editor side reads them, at call time.
+    /// </summary>
+    public static class SecureKeyStore
+    {
+        private static ISecureKeyStore _current;
+
+        public static ISecureKeyStore Current => _current ??= Build();
+
+        /// <summary>Test seam: substitute an in-memory or temp-dir store.</summary>
+        internal static void OverrideForTests(ISecureKeyStore store) => _current = store;
+
+        /// <summary>Test seam: clear the cached instance.</summary>
+        internal static void ResetForTests() => _current = null;
+
+        private static ISecureKeyStore Build() => new EnvOverlayKeyStore(SelectPlatform());
+
+        private static ISecureKeyStore SelectPlatform()
+        {
+            switch (Application.platform)
+            {
+                case RuntimePlatform.OSXEditor:
+                    return new MacKeychainKeyStore();
+                case RuntimePlatform.WindowsEditor:
+                    return new WindowsCredentialKeyStore();
+                case RuntimePlatform.LinuxEditor:
+                    return LinuxSecretToolKeyStore.IsAvailable()
+                        ? (ISecureKeyStore)new LinuxSecretToolKeyStore()
+                        : new EncryptedFileKeyStore();
+                default:
+                    return new EncryptedFileKeyStore();
+            }
+        }
+    }
+
+    /// <summary>
+    /// Wraps a platform store so an <c>MCPFORUNITY_&lt;PROVIDER&gt;_API_KEY</c> environment
+    /// variable takes precedence on reads. Writes always go to the underlying store.
+    /// </summary>
+    internal sealed class EnvOverlayKeyStore : ISecureKeyStore
+    {
+        private readonly ISecureKeyStore _inner;
+
+        public EnvOverlayKeyStore(ISecureKeyStore inner) { _inner = inner; }
+
+        public bool TryGet(string providerId, out string apiKey)
+        {
+            if (EnvKeyOverride.TryGet(providerId, out apiKey)) return true;
+            return _inner.TryGet(providerId, out apiKey);
+        }
+
+        public bool Has(string providerId)
+            => EnvKeyOverride.TryGet(providerId, out _) || _inner.Has(providerId);
+
+        public void Set(string providerId, string apiKey) => _inner.Set(providerId, apiKey);
+
+        public void Delete(string providerId) => _inner.Delete(providerId);
+    }
+}