quarto-dev / quarto-dev/quarto

Reading Zotero API key at startup causes safe storage prompt in Positron

Open
#659 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

vscode
Dominant language
TypeScript
Stars
645
Forks
62
Avg merge
17h 42m
Merged PRs (30d)
13

Description

With the Quarto extension enabled, opening a new Positron window will always result in a prompt like this one, unless you've already granted Positron access to safe storage.

Image

This happens in part because the Quarto extension attempts to access safe storage when the extension starts; when we initialize Zotero as part of extension activation, this happens:

https://github.com/quarto-dev/quarto/blob/57ed6fb2ab6066a6a4f0333c0c968586701e006a/apps/vscode/src/providers/zotero/zotero.ts#L362-L369

Unfortunately just checking for a key in safe storage is enough to trigger an access that results in a prompt. This is unavoidable if we really do need to read a secret, but in most cases we don't. Could we load this API key lazily so the user doesn't get prompted until we use the key, and/or store out-of-band a marker indicating whether there is an API key to read (so we don't hit the storage service unnecessarily when there isn't one)?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at apps/vscode/src/providers/zotero/zotero.ts lines 362-369 and trace how Zotero is initialized during extension activation. Reproduce the prompt by opening a new Positron window with the Quarto extension enabled, then verify that safe storage is not accessed until the API key is needed and that existing key behavior still works.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript, vscode
Domain
desktop, developer-experience, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.