SLVS-2796 Implement alternative Credentials Storage

[georgii-borovinskikh-sonarsource]

Part of

[hashicorp-vault-sonar-prod]

SLVS-2796

[sonarqubecloud]

SonarQube reviewer guide

Important

We are currently testing different models for AI Summary.
Please give us your feedback by filling this form.

Model A:

Summary: Implement DPAPI credential storage with a new storage mechanism and refactor credential handling.

Review Focus:

• New DPAPI credential encryption/decryption implementation (security-critical)
• Aggregating loader pattern properly routing between Default and DPAPI storage types
• Migration path and backward compatibility for existing credentials
• Proper disposal and secure handling of SecureString instances

Start review at: src/ConnectedMode/Persistence/DpapiCurrentUserCredentialsLoader.cs. This is the core new security implementation that encrypts/persists credentials using Windows DPAPI and must be thoroughly validated for secure data handling.

Model B:

Summary: Implement DPAPI-based credential storage with user-selectable storage backends, adding support for encrypted token credentials as an alternative to the default credential store.

Review Focus:

• The credential storage refactoring introduces a plugin architecture with multiple implementations (DefaultBindingCredentialsLoader, DpapiCurrentUserCredentialsLoader). Verify that the AggregatingSolutionBindingCredentialsLoader correctly routes operations to the selected implementation.
• DPAPI implementation handles sensitive data (encryption/decryption of tokens). Ensure proper SecureString usage and memory cleanup.
• Settings persistence and UI integration for the new CredentialStoreType enum—verify the default value handling and migration path.
• Dependency injection changes are extensive; confirm all MEF exports/imports align correctly, especially in ServerConnectionsRepository and SolutionBindingRepository.

Start review at: src/ConnectedMode/Persistence/AggregatingSolutionBindingCredentialsLoader.cs. This is the central orchestrator that determines which credential loader implementation to use based on user settings, making it critical to understand the overall flow before reviewing individual implementations.

Quality Gate passed

Issues
0 New issues
1 Accepted issue
0 Dependency risks

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud