Remove "legacy" credential handler

Author: omarroth

cmd/doubletake/main.go

@@ -88,14 +88,15 @@ func main() {
 	// 2. If saved credentials exist, load them and do pair-verify only
 	// 3. Otherwise, do transient (ephemeral) pairing
 	needFullPair := *forcePair || *pin != ""
-	var savedCreds *airplay.SavedCredentials
 
+	credStore, err := airplay.NewCredentialStore(*credFile)
+	if err != nil {
+		log.Fatalf("failed to load credentials: %v", err)
+	}
+
+	var savedCreds *airplay.SavedCredentials
 	if !needFullPair {
-		var err error
-		savedCreds, err = airplay.LoadCredentials(*credFile)
-		if err != nil {
-			log.Printf("warning: failed to load credentials: %v", err)
-		}
+		savedCreds = credStore.Lookup(info.DeviceID)
 	}
 
 	if needFullPair {
@@ -113,7 +114,7 @@ func main() {
 			log.Fatalf("pairing failed: %v", err)
 		}
 		// Save credentials for next time
-		if err := airplay.SaveCredentials(*credFile, client.PairingID, client.PairKeys.Ed25519Public, client.PairKeys.Ed25519Private); err != nil {
+		if err := credStore.Save(info.DeviceID, client.PairingID, client.PairKeys.Ed25519Public, client.PairKeys.Ed25519Private); err != nil {
 			log.Printf("warning: failed to save credentials: %v", err)
 		} else {
 			log.Printf("credentials saved to %s", *credFile)

internal/airplay/credentials.go

@@ -26,56 +26,6 @@ func DefaultCredentialsPath() string {
 	return filepath.Join(dir, "doubletake", "credentials.json")
 }
 
-// SaveCredentials writes pairing credentials to disk (legacy single-device format).
-func SaveCredentials(path string, pairingID string, pub ed25519.PublicKey, priv ed25519.PrivateKey) error {
-	creds := SavedCredentials{
-		PairingID:     pairingID,
-		Ed25519Public: []byte(pub),
-		Ed25519Seed:   priv.Seed(),
-	}
-	data, err := json.MarshalIndent(creds, "", "  ")
-	if err != nil {
-		return fmt.Errorf("marshal credentials: %w", err)
-	}
-	if err := os.WriteFile(path, data, 0600); err != nil {
-		return fmt.Errorf("write credentials: %w", err)
-	}
-	return nil
-}
-
-// LoadCredentials reads pairing credentials from disk.
-// Supports both the legacy single-device format and the multi-device map format
-// written by CredentialStore. Returns nil, nil if the file doesn't exist.
-func LoadCredentials(path string) (*SavedCredentials, error) {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil, nil
-		}
-		return nil, fmt.Errorf("read credentials: %w", err)
-	}
-
-	// Try multi-device format first (map[string]*SavedCredentials)
-	var multi map[string]*SavedCredentials
-	if err := json.Unmarshal(data, &multi); err == nil && len(multi) > 0 {
-		for _, creds := range multi {
-			if creds != nil && creds.PairingID != "" {
-				return creds, nil
-			}
-		}
-	}
-
-	// Fall back to legacy single-device format
-	var creds SavedCredentials
-	if err := json.Unmarshal(data, &creds); err != nil {
-		return nil, fmt.Errorf("unmarshal credentials: %w", err)
-	}
-	if creds.PairingID == "" {
-		return nil, nil
-	}
-	return &creds, nil
-}
-
 // Ed25519Keys reconstructs the key pair from saved credentials.
 func (c *SavedCredentials) Ed25519Keys() (ed25519.PublicKey, ed25519.PrivateKey) {
 	if len(c.Ed25519Seed) != ed25519.SeedSize {
@@ -105,17 +55,8 @@ func NewCredentialStore(path string) (*CredentialStore, error) {
 		}
 		return nil, fmt.Errorf("read credential store: %w", err)
 	}
-	// Try multi-device format first
 	if err := json.Unmarshal(data, &cs.devices); err != nil {
-		// Fall back to legacy single-device format
-		var single SavedCredentials
-		if err2 := json.Unmarshal(data, &single); err2 != nil {
-			return nil, fmt.Errorf("unmarshal credential store: %w", err)
-		}
-		// Store under empty key — will be re-keyed on first successful connect
-		if single.PairingID != "" {
-			cs.devices[""] = &single
-		}
+		return nil, fmt.Errorf("unmarshal credential store: %w", err)
 	}
 	return cs, nil
 }
@@ -124,11 +65,7 @@ func NewCredentialStore(path string) (*CredentialStore, error) {
 func (cs *CredentialStore) Lookup(deviceID string) *SavedCredentials {
 	cs.mu.Lock()
 	defer cs.mu.Unlock()
-	if creds := cs.devices[deviceID]; creds != nil {
-		return creds
-	}
-	// Check legacy empty-key entry
-	return cs.devices[""]
+	return cs.devices[deviceID]
 }
 
 // Len returns the number of stored credential entries.
@@ -138,13 +75,6 @@ func (cs *CredentialStore) Len() int {
 	return len(cs.devices)
 }
 
-// Import adds a credential entry without persisting (used for legacy migration at startup).
-func (cs *CredentialStore) Import(deviceID string, creds *SavedCredentials) {
-	cs.mu.Lock()
-	defer cs.mu.Unlock()
-	cs.devices[deviceID] = creds
-}
-
 // Save stores credentials for a device and persists to disk.
 func (cs *CredentialStore) Save(deviceID string, pairingID string, pub ed25519.PublicKey, priv ed25519.PrivateKey) error {
 	cs.mu.Lock()
@@ -155,10 +85,6 @@ func (cs *CredentialStore) Save(deviceID string, pairingID string, pub ed25519.P
 		Ed25519Public: []byte(pub),
 		Ed25519Seed:   priv.Seed(),
 	}
-	// Remove legacy empty-key entry if we now have a proper key
-	if deviceID != "" {
-		delete(cs.devices, "")
-	}
 	return cs.persist()
 }
 

internal/daemon/daemon.go

@@ -111,15 +111,6 @@ func New(cfg Config) (*Daemon, error) {
 		return nil, fmt.Errorf("load credentials: %w", err)
 	}
 
-	// If the credential store is empty, try importing from the legacy file
-	if cs.Len() == 0 && cfg.CredFile != "" {
-		legacyCreds, lerr := airplay.LoadCredentials(cfg.CredFile)
-		if lerr == nil && legacyCreds != nil {
-			cs.Import("", legacyCreds)
-			log.Printf("[daemon] imported legacy credentials from %s", cfg.CredFile)
-		}
-	}
-
 	return &Daemon{
 		cfg:            cfg,
 		state:          StateIdle,