Documentation
¶
Overview ¶
Package pypi provides a verifier for PyPI API tokens. It uses the PyPI upload endpoint with Basic auth to check token validity. A 405 (Method Not Allowed) response indicates a valid token (authenticated but wrong HTTP method), while 401/403 indicates an invalid token.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Verifier ¶
type Verifier struct {
// contains filtered or unexported fields
}
Verifier checks whether a PyPI API token is active by calling the PyPI upload endpoint. It NEVER logs or persists raw token values.
func (*Verifier) Verify ¶
func (v *Verifier) Verify(ctx context.Context, raw detector.RawFinding) finding.VerificationResult
Verify checks if the detected PyPI API token is valid/active. Raw contains the token value. The upload endpoint answers an authenticated GET with 405 (wrong method), which is the positive signal; 401/403 means the token is rejected.
Source Files
Click to show internal directories.
Click to hide internal directories.