store/keychain: windows filter support

Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>

Author: Benehiko

store/keychain/keychain_windows.go

@@ -104,11 +104,20 @@ func isServiceCredential[T store.Secret](k *keychainStore[T], attrs []wincred.Cr
 	return strings.EqualFold(serviceGroup, k.serviceGroup) && strings.EqualFold(serviceName, k.serviceName)
 }
 
+// hasAttribute iterates over the credential attributes (attrs) and checks if
+// each key exists in the attributes map. If they exist, it compares their values
+// each attribute inside attributes must match what is stored in the credential
+// attributes (attrs) to return true.
 func hasAttribute(attributes map[string]string, attrs []wincred.CredentialAttribute) bool {
+	if attributes == nil {
+		return true
+	}
 	allMatch := make([]bool, len(attributes))
+	var i int
 	for _, attr := range attrs {
-		if v, ok := attributes[attr.Keyword]; ok && v == string(attr.Value) {
-			allMatch = append(allMatch, true)
+		if v, ok := attributes[attr.Keyword]; ok && strings.EqualFold(v, string(attr.Value)) {
+			allMatch[i] = true
+			i++
 		}
 	}
 	return !slices.Contains(allMatch, false)
@@ -159,36 +168,44 @@ func (k *keychainStore[T]) Save(ctx context.Context, id store.ID, secret store.S
 		return err
 	}
 
-	g := wincred.NewGenericCredential(k.itemLabel(id))
-	g.UserName = id.String()
-	g.CredentialBlob = blob
-	g.Persist = wincred.PersistLocalMachine
-	g.Attributes = []wincred.CredentialAttribute{
-		{
-			Keyword: "id",
-			Value:   []byte(id.String()),
-		},
-		{
-			Keyword: "service:group",
-			Value:   []byte(k.serviceGroup),
-		},
-		{
-			Keyword: "service:name",
-			Value:   []byte(k.serviceName),
-		},
-	}
-
+	attributes := []wincred.CredentialAttribute{}
 	parts := strings.SplitSeq(id.String(), "/")
 	for p := range parts {
 		if p == "" {
 			continue
 		}
-		g.Attributes = append(g.Attributes, wincred.CredentialAttribute{
+		attributes = append(attributes, wincred.CredentialAttribute{
 			Keyword: p,
 			Value:   []byte(p),
 		})
 	}
+	for k, v := range secret.Metadata() {
+		attributes = append(attributes, wincred.CredentialAttribute{
+			Keyword: k,
+			Value:   []byte(v),
+		})
+	}
+
+	attributes = append(attributes,
+		wincred.CredentialAttribute{
+			Keyword: "id",
+			Value:   []byte(id.String()),
+		},
+		wincred.CredentialAttribute{
+			Keyword: "service:group",
+			Value:   []byte(k.serviceGroup),
+		},
+		wincred.CredentialAttribute{
+			Keyword: "service:name",
+			Value:   []byte(k.serviceName),
+		},
+	)
 
+	g := wincred.NewGenericCredential(k.itemLabel(id))
+	g.UserName = id.String()
+	g.CredentialBlob = blob
+	g.Persist = wincred.PersistLocalMachine
+	g.Attributes = attributes
 	return mapWindowsCredentialError(g.Write())
 }