Encrypting the Managed CleanRoom token cache file

src/managedcleanroom/HISTORY.rst

@@ -81,3 +81,7 @@ Release History
   encryption-mode compatibility is enforced by the service.
 * SDK: ``analytics_frontend_api`` updated with the new ``store.subdirectory`` field
   in the JSON dict templates (sync + async) to match the regenerated autorest output.
+
+1.0.0b8
++++++++
+* Add encryption for token cache.

src/managedcleanroom/azext_managedcleanroom/_msal_auth.py

@@ -108,7 +108,7 @@ def get_msal_cache_file():
 
     :return: Path to token cache file
     """
-    return get_msal_cache_dir() / "token_cache.json"
+    return get_msal_cache_dir() / "token_cache_enc.json"
 
 
 def load_cache(msal_token_cache_file):
@@ -123,7 +123,8 @@ def load_cache(msal_token_cache_file):
 
     cache = SerializableTokenCache()
     if os.path.exists(msal_token_cache_file):
-        cache.deserialize(open(msal_token_cache_file, "r").read())
+        persistence = build_persistence(msal_token_cache_file)
+        cache.deserialize(persistence.load())
     return cache
 
 
@@ -136,8 +137,18 @@ def save_cache(cache, msal_token_cache_file):
     :param msal_token_cache_file: Path to cache file
     """
     if cache.has_state_changed:
-        with open(msal_token_cache_file, "w") as f:
-            f.write(cache.serialize())
+        persistence = build_persistence(msal_token_cache_file)
+        persistence.save(cache.serialize())
+
+
+def build_persistence(msal_token_cache_file):
+    """Build a suitable persistence instance based on current OS
+
+    :param msal_token_cache_file: Path to cache file
+    """
+    from msal_extensions import build_encrypted_persistence
+
+    return build_encrypted_persistence(msal_token_cache_file)
 
 
 def perform_device_code_flow(cmd):

src/managedcleanroom/setup.py

@@ -10,7 +10,7 @@
 
 
 # HISTORY.rst entry.
-VERSION = '1.0.0b7'
+VERSION = '1.0.0b8'
 
 # The full list of classifiers is available at
 # https://pypi.python.org/pypi?%3Aaction=list_classifiers