Shutong Wu
e728c35adb
OS secure store per platform: macOS Keychain (/usr/bin/security), Windows Credential Manager (advapi32 P/Invoke), Linux secret-tool; AES-256-CBC+HMAC encrypt-then-MAC fallback (CI-safe, master secret + machine id via PBKDF2, ciphertext under user app-data, never in repo). Env override (MCPFORUNITY_<P>_API_KEY, read-only) layered on top; SecretRedactor scrubs auth tokens. Keys never touch EditorPrefs/bridge/logs/git. EditMode tests for fallback round-trip, encryption-at-rest, env override, redaction. Compiles clean on Unity 2021.3.45f2 (floor). Claude-Session: https://claude.ai/code/session_01Tjpb5gYgUe2AUJuRdXr7Lv
27 lines
1002 B
C#
27 lines
1002 B
C#
using System;
|
|
|
|
namespace MCPForUnity.Editor.Security
|
|
{
|
|
/// <summary>
|
|
/// Read-only environment-variable override for provider keys, intended for CI/headless
|
|
/// and power users. Resolution order is env → secure store (see <see cref="SecureKeyStore"/>).
|
|
/// Env values are never written back to any store.
|
|
/// </summary>
|
|
internal static class EnvKeyOverride
|
|
{
|
|
/// <summary>e.g. "tripo" → "MCPFORUNITY_TRIPO_API_KEY".</summary>
|
|
internal static string EnvVarName(string providerId)
|
|
=> "MCPFORUNITY_" + (providerId ?? string.Empty).ToUpperInvariant() + "_API_KEY";
|
|
|
|
internal static bool TryGet(string providerId, out string apiKey)
|
|
{
|
|
apiKey = null;
|
|
if (string.IsNullOrEmpty(providerId)) return false;
|
|
string v = Environment.GetEnvironmentVariable(EnvVarName(providerId));
|
|
if (string.IsNullOrEmpty(v)) return false;
|
|
apiKey = v;
|
|
return true;
|
|
}
|
|
}
|
|
}
|