auth

func Contexts ¶ added in v0.7.0

func Contexts() ([]*contexts.Context, string, error)

Contexts returns all stored login contexts and the current context name, for listing/switching. Order matches on-disk order.

func CoreURLFromEnvToken ¶ added in v0.7.4

func CoreURLFromEnvToken(rawToken string) (string, error)

CoreURLFromEnvToken derives the home-region core URL from an ENTIRE_TOKEN JWT's audience claim. Login and sa-session JWTs carry aud=<home-region URL>, which is what STS routing keys on — so we read aud, not iss (iss may be a regional core that can't mint the cross-region exchange).

SECURITY: the returned URL becomes the host the env token is POSTed to as a subject_token during exchange. ParseClaims does NOT verify the signature, so the audience is attacker-controlled if a forged token is injected. This function only enforces the *shape* of a safe endpoint (https, bare origin); the caller MUST additionally verify the URL is a trusted core for the target cluster (see clusterdiscovery.ResolveClusterCores) before exchanging, or a forged aud could redirect the token to an arbitrary host.

Structural rules, all required:

• the aud is a well-formed absolute URL,
• scheme is https (no cleartext token exchange),
• it carries a host and no userinfo, path, query, or fragment — entire cores are bare origins (https://core.example.com), so anything richer is either a misconfigured token or an attempt to smuggle a path/redirect.

The aud claim may be a single string or an array (RFC 7519 §4.1.3); ParseClaims normalises both to a slice. Non-URL audiences (e.g. an OAuth client_id like "entire-cli") are skipped; the first URL-shaped audience is validated strictly. A token with no URL-shaped aud is rejected with a clear error rather than silently falling back to context resolution.

func CurrentContextToken ¶ added in v0.7.0

func CurrentContextToken() (string, bool)

CurrentContextToken returns the login JWT for the active context in contexts.json, or ("", false) when there is no current context or it has no stored token. This is the contexts.json half of the CLI's credential resolution; callers fall back to the legacy keyring entry so pre-contexts logins keep working until migrated.

func EnableInsecureHTTP ¶ added in v0.6.3

func EnableInsecureHTTP()

EnableInsecureHTTP relaxes the package-level manager's HTTPS guard so non-loopback http:// resources (and the auth host's STS endpoint) are permitted during token resolution. The CLI calls this when the user passes --insecure-http-auth to a command that hits the data API on a private network (e.g. a split-host local-dev box where both hosts are plain HTTP).

Call before any TokenForResource invocation — the manager is built lazily on first use and the AllowInsecureHTTP setting is frozen at that point.

func LoginTokenForContext ¶ added in v0.7.0

func LoginTokenForContext(c *contexts.Context) (string, error)

LoginTokenForContext returns the login JWT stored for c, read from the OS keyring slot the context points at. The encoded expiry is stripped; the server is the authority on validity and the device-flow login holds no refresh token, so an expired token surfaces as a 401 the caller can translate into a re-login hint.

func LookupCurrentToken ¶

func LookupCurrentToken() (string, error)

LookupCurrentToken retrieves the active login token. It prefers the current contexts.json context (so a login from this or entiredb's CLIs authenticates control-plane commands), falling back to the legacy entry keyed by the auth issuer (api.AuthBaseURL()) for pre-contexts logins.

func MigrateLegacyLoginContext ¶ added in v0.7.0

func MigrateLegacyLoginContext() (migrated bool, err error)

MigrateLegacyLoginContext bridges users who logged in before the contexts.json dual-write existed: if the legacy entire-cli/<authBaseURL> keyring entry holds a usable JWT and no context yet covers its issuer, it records an equivalent context (and keychain entry under the shared scheme) so the git remote helper can authenticate without a re-login.

Returns (true, nil) when it created a context. No-ops — returning (false, nil) — when there's no legacy token, the token is opaque (no derivable issuer), or a context for that issuer already exists. Idempotent: safe to call on every helper invocation.

func NewRefreshingLoginProvider ¶ added in v0.7.4

func NewRefreshingLoginProvider(c *contexts.Context, transport http.RoundTripper, allowInsecureHTTP bool) (func(context.Context) (string, error), error)

NewRefreshingLoginProvider returns a login-JWT provider (the shape repocreds wants) for context c that transparently re-mints an expired login JWT from the stored refresh token.

It is backed by auth-go's tokenmanager, which is what makes this safe against the server's single-use refresh-token rotation: refreshes are serialised across processes (an advisory file lock) and goroutines, the store is re-read after locking so a late waiter reuses a peer's freshly minted token, and the rotated refresh token is persisted. Without that, two concurrent git-remote-entire processes (e.g. a recursive submodule fetch) could replay the same single-use token and trip the server's reuse detection, revoking the whole family.

Behaviour is a strict superset of the old read-only provider: a still valid token is returned with no network call; a context with no refresh token (e.g. a login predating offline_access) behaves exactly as before — valid token used, expired token surfaces a re-login error.

transport carries the caller's TLS configuration; allowInsecureHTTP permits an http:// core for loopback/dev.

func RecordLoginContext ¶ added in v0.7.0

func RecordLoginContext(rawToken, refreshToken string, activate bool) (string, error)

RecordLoginContext records a freshly obtained login token in the shared contexts.json credential model: it derives the issuer (core URL), handle, and expiry from the token's own claims, stores the token in the OS keyring under the entire-core:<issuer> service scheme entiredb uses, and writes (or updates) the matching context.

Contexts are keyed by identity (core URL + handle): re-logging into the same identity updates its context in place, while a second identity on the same core gets its own context (named handle@host) instead of clobbering the first.

activate controls current_context: login passes true (the just-completed login becomes active, kubectl use-context style); read-time migration passes false so it never silently switches the user's active account — it still sets current_context when none exists yet.

This is the contexts.json half of login's dual-write: the legacy entire-cli/<authBaseURL> keyring entry is still written by the caller so the control-plane readers keep working untouched during the transition. A login recorded here is visible to entiredb's CLIs (and the in-CLI git remote helper) because they share this file and keychain layout.

Returns the context name on success. Errors are returned (not swallowed) so the caller can warn; login still succeeds on the legacy entry.

func RemoveContext ¶ added in v0.7.4

func RemoveContext(name string) error

RemoveContext deletes the named context from contexts.json and its keyring tokens. A missing context is a no-op. Used by `logout --all-contexts` to drain every saved login. File.Delete clears current_context when name was the active one, so removing the current context this way also logs it out.

func RemoveCurrentContext ¶ added in v0.7.0

func RemoveCurrentContext() error

RemoveCurrentContext deletes the active context from contexts.json and its keyring token, clearing current_context. It is a no-op (returns nil) when there is no current context. Used by logout.

func RepoScopedToken ¶ added in v0.7.0

func RepoScopedToken(ctx context.Context, clusterBaseURL, repoSlug, action string) (string, error)

RepoScopedToken exchanges the logged-in user's token for a short-lived, repo-scoped access token usable against a data-plane cluster's git endpoints (clone / fetch / info-refs).

The data plane's git gate rejects the raw login bearer (HTTP 403): it only accepts a token whose RFC 8693 audience is <clusterBaseURL><repoSlug> and whose scope is "repo:<action>". This is the same exchange git-remote-entire performs internally for the entire:// transport — the CLI does it in-process when it needs to read the data plane directly (e.g. probing a mirror's clone readiness).

• clusterBaseURL is the data-plane cluster origin (scheme+host, e.g. https://aws-us-east-2.entire.io); a trailing slash is trimmed.
• repoSlug is the full surface-prefixed path (e.g. /gh/octocat/hello or /et/<project>/<repo>), joined to the cluster URL verbatim to form the audience.
• action is "pull" for reads or "push" for writes.

The exchange targets the same core endpoint and client identity the CLI logged in against (AuthBaseURL + the provider's STS path, client_id entire-cli), so a successful login implies a usable exchange. Errors surface verbatim from the STS endpoint (e.g. invalid_target when no mirror matches the slug+cluster).

The subject token is the stored login access token read directly, rather than routed through the refresh-aware tokenmanager. That's deliberate for two reasons: (1) `entire login` (device flow) stores only a bare access token — no refresh token — so there is nothing the manager could refresh that this path can't equally use; an expired login token fails both ways. (2) The manager's exchange also emits an RFC 8693 `resource` parameter alongside `audience`, whereas the data-plane gate keys solely on `audience`; going direct keeps the wire form byte-for-byte what git-remote-entire (and the standalone entiredb CLI) already send. Each call performs a fresh exchange and does not cache — callers that poll (e.g. the mirror clone wait) re-invoke on token expiry. If the CLI gains refresh tokens, route this through the tokenmanager instead.

func SetCurrentContext ¶ added in v0.7.0

func SetCurrentContext(name string) error

SetCurrentContext makes name the active context. Returns an error when no context with that name exists (a stale current pointer is a foot-gun).

func SetManagerForTest ¶ added in v0.6.3

func SetManagerForTest(t interface{ Helper() }, mgr *tokenmanager.Manager) func()

SetManagerForTest installs mgr as the manager returned by defaultManager() and returns a cleanup function. Test-only.

func SetProviderForTest ¶ added in v0.6.3

func SetProviderForTest(t interface {
	Helper()
	Cleanup(f func())
}, p Provider)

SetProviderForTest installs p as the Provider returned by CurrentProvider for the duration of the test, and registers a t.Cleanup to remove the override. Test-only.

Takes a tiny interface rather than *testing.T so production builds don't import testing.

func SetRepoExchangeTransportForTest ¶ added in v0.7.0

func SetRepoExchangeTransportForTest(rt http.RoundTripper) func()

SetRepoExchangeTransportForTest installs rt as the transport used by RepoScopedToken and returns a cleanup function. Test-only.

func TokenForResource ¶ added in v0.6.3

func TokenForResource(ctx context.Context, resourceBaseURL string) (string, error)

TokenForResource returns a bearer token suitable for use against resourceBaseURL, performing an RFC 8693 token exchange when the stored core token's audience doesn't already cover that resource. See tokenmanager.Manager.Token for the full resolution rules.