fix(secrets): Reduce keychain unlock prompts on MacOS

[t1m0thyj]

What It Does

Reduces the number of keychain unlock prompts on MacOS for simultaneous access to secrets by multiple instances of the same application.

As a security feature, MacOS always re-prompts for keychain access after a secret has been modified by another process. This is why after running zowe config secure which updates credentials using node, you get a prompt for Zowe Explorer (the VS Code extension host process) to access credentials.

Suppose there are 3 VS Code instances open: A, B, and C. Currently when a vault change event is triggered, all 3 instances attempt to access the keychain simultaneously and Mac users will see 3 keychain prompts (ouch).

By adding a mutex associated with the calling process, we can make B & C wait to access credentials until A has finished accessing them. Now Mac users will see just 1 keychain prompt (0 would be ideal but 1 is way better than 3).

How to Test

This PR can only be tested on MacOS since the issue is OS-specific:

1. Download the keyring.node artifact and copy it into your ZE prebuilds folder.
2. Dequarantine the file with the command xattr -d com.apple.quarantine *.node
3. Close all VS Code windows and re-open multiple of them.
4. Run the zowe config secure command and press Enter repeatedly to skip all prompts.
5. Notice that only 1 prompt is shown for keychain access.

Review Checklist
I certify that I have:

• tested my changes
• added/updated automated tests
• updated the changelog
• followed the contribution guidelines

Additional Comments

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 91.32%. Comparing base (bf77e64) to head (9040008).
Report is 13 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2394   +/-   ##
=======================================
  Coverage   91.32%   91.32%           
=======================================
  Files         638      638           
  Lines       18210    18210           
  Branches     3823     3823           
=======================================
  Hits        16630    16630           
  Misses       1579     1579           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[traeok]

Changes make sense to me, thanks for the fix @t1m0thyj - pretty cool that fmutex leverages the scope of the guard to auto-release the lock 😋

As discussed offline, failing tests are related to glibc segfault with ava - once workerThreads: false is added, the stages will pass. Thanks for looking into this as well!

[github-actions]

📅 Suggested merge-by date: 1/20/2025

[gejohnston]

A small suggestion about the changelog. Otherwise ready to approve.

[zFernand0]

Changes LGTM! 😋

[anaxceron]

We should add an issue or PR link to the changelog entry

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Release succeeded for the master branch. 🎉

The following packages have been published:

• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]
• npm: @zowe/[email protected]

_{Powered by Octorelease 🚀}