Documentation
¶
Overview ¶
Package credstore is the CLI's credential store. It owns the OS keyring and the 0600 JSON file fallback (CLI-specific concerns), and exposes stored credentials to the freelo-go SDK via a CredentialsFunc adapter.
Login / logout / status commands talk to *Store. The transport in the SDK only sees the Provider returned by AsProvider — it has no knowledge of where credentials live.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Keyring ¶
type Keyring interface {
Get(service, key string) (string, error)
Set(service, key, value string) error
Delete(service, key string) error
}
Keyring is the interface for credential storage.
Two implementations:
- osKeyring (default) — Keychain on macOS, Credential Manager on Windows, Secret Service on Linux desktop, via zalando/go-keyring.
- fileKeyring (fallback) — 0600 JSON in ~/.config/freelo/, used when the user opts in via FREELO_KEYRING=file (headless Linux, Docker without DBus, sandboxed CI runners).
Tests use a third in-memory mock that lives in auth_test.go.
func NewKeyring ¶
NewKeyring returns the keyring backend appropriate for the runtime.
`fallbackFilename` is only consulted when the file backend is selected; pass "credentials.json" for prod, "credentials-dev.json" for --dev.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store wraps a Keyring with the namespacing and env-var override rules the CLI needs. The keyring is addressed under a service namespace that differs between prod (`freelo-cli`) and dev (`freelo-cli-dev`) so the two never collide in Keychain / Credential Manager / Secret Service.
func New ¶
New creates a Store for either prod or dev mode. In dev mode the keyring service name AND the file-fallback filename are suffixed with "-dev" so dev credentials don't shadow prod.
func (*Store) AsProvider ¶
func (s *Store) AsProvider() freeloauth.Provider
AsProvider returns a freelo-go auth provider that resolves credentials per outgoing request via GetCredentials. This is the seam between the CLI's keyring-aware storage and the SDK's transport. The SDK never touches the keyring directly.
func (*Store) Clear ¶
Clear removes both fields from the keyring. Errors are ignored — the goal is "leave the keyring without our credentials", and a missing entry is the same outcome as a successful delete.
func (*Store) GetCredentials ¶
GetCredentials returns the email and API key for outbound requests. Env vars take priority for CI / agent / sandboxed runs; the keyring is the fallback used by interactive login flows.
func (*Store) IsAuthenticated ¶
IsAuthenticated reports whether GetCredentials currently returns a pair. Does not contact the API — credential validity is a server-side question.
Source Files