Documentation
¶
Overview ¶
Package credstore is the CLI's credential store. It owns the OS keyring and the 0600 JSON file fallback (CLI-specific concerns), and exposes stored credentials to the freelo-go SDK via a CredentialsFunc adapter.
Login / logout / status commands talk to *Store. The transport in the SDK only sees the Provider returned by AsProvider — it has no knowledge of where credentials live.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Keyring ¶
type Keyring interface {
Get(service, key string) (string, error)
Set(service, key, value string) error
Delete(service, key string) error
}
Keyring is the interface for credential storage.
Two implementations:
- osKeyring (default) — Keychain on macOS, Credential Manager on Windows, Secret Service on Linux desktop, via zalando/go-keyring.
- fileKeyring (fallback) — 0600 JSON in ~/.config/freelo/, used when the user opts in via FREELO_KEYRING=file (headless Linux, Docker without DBus, sandboxed CI runners).
Tests use a third in-memory mock that lives in auth_test.go.
func NewKeyring ¶
NewKeyring returns the keyring backend appropriate for the runtime.
`fallbackFilename` is only consulted when the file backend is selected; pass "credentials.json" for prod, "credentials-dev.json" for --dev.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store wraps a Keyring with the namespacing and env-var override rules the CLI needs. The keyring is addressed under a service namespace that differs between prod (`freelo-cli`) and dev (`freelo-cli-dev`) so the two never collide in Keychain / Credential Manager / Secret Service.
func New ¶
New creates a Store for either prod or dev mode. In dev mode the keyring service name AND the file-fallback filename are suffixed with "-dev" so dev credentials don't shadow prod.
func (*Store) AsProvider ¶
func (s *Store) AsProvider() freeloauth.Provider
AsProvider returns a freelo-go auth provider that resolves credentials per outgoing request via GetCredentials. This is the seam between the CLI's keyring-aware storage and the SDK's transport. The SDK never touches the keyring directly.
func (*Store) Clear ¶
Clear removes both fields from the keyring. Errors are ignored — the goal is "leave the keyring without our credentials", and a missing entry is the same outcome as a successful delete.
func (*Store) GetCredentials ¶
GetCredentials returns the email and API key for outbound requests. Env vars take priority for CI / agent / sandboxed runs; the keyring is the fallback used by interactive login flows.
func (*Store) IsAuthenticated ¶
IsAuthenticated reports whether GetCredentials currently returns a pair. Does not contact the API — credential validity is a server-side question.
func (*Store) Store ¶
Store persists credentials to the keyring under this Store's namespace.
If the second Set fails after the first succeeded, we roll back the first write so the store never sits in a half-saved state where GetCredentials would return "API key not found" instead of "not authenticated" and confuse the user.
Source Files