Documentation
¶
Index ¶
- func DeleteToken(host string) error
- func DeviceLogin(host string, ios *iostreams.IOStreams) (string, error)
- func GetToken(host string) (string, error)
- func ReadTokenFromStdin(ios *iostreams.IOStreams) (string, error)
- func SetToken(host, token string) error
- type AuthMethod
- type ResolvedToken
- type TokenInfo
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DeleteToken ¶
DeleteToken removes the stored token for the given host from the OS keychain. Returns nil if no token exists for that host.
func DeviceLogin ¶
DeviceLogin implements the Device Authorization Grant (RFC 8628). It requests a device code, prints the verification URL and user code, then polls until the user authorises or the code expires.
func GetToken ¶
GetToken retrieves the token for the given host from the OS keychain. Returns an empty string (and nil error) if no token is stored for the host.
func ReadTokenFromStdin ¶
ReadTokenFromStdin reads an API key without echoing it when stdin is a terminal.
Piped input is unchanged, so `echo $KEY | kh auth login --with-token` and CI usage keep working exactly as before. What changes is the interactive case: running the command with no pipe used to leave the terminal echoing, so the key appeared on screen and stayed in scrollback. An organisation API key is a bearer credential, and a terminal is a bad place to leave one lying around.
Echo suppression is verified rather than assumed. term.ReadPassword tells us whether it could put the terminal into no-echo mode, and if it cannot, this returns an error instead of falling back to a visible read. Failing closed costs the user one message; failing open costs them the key.
Types ¶
type AuthMethod ¶
type AuthMethod string
AuthMethod describes how the token was resolved.
const ( AuthMethodAPIKey AuthMethod = "api-key" AuthMethodToken AuthMethod = "token" AuthMethodNone AuthMethod = "none" )
type ResolvedToken ¶
type ResolvedToken struct {
Token string
Method AuthMethod
Host string
}
ResolvedToken holds a resolved token and its source.
func ResolveToken ¶
func ResolveToken(host string) (ResolvedToken, error)
ResolveToken resolves the auth token for host using the priority chain: 1. KH_API_KEY environment variable 2. hosts.yml token field 3. OS keyring (legacy fallback -- tokens are migrated to hosts.yml on login) Returns a ResolvedToken with Method set to AuthMethodNone if no token found.
type TokenInfo ¶
type TokenInfo struct {
UserID string
Email string
Name string
OrgID string
OrgName string
Role string
ExpiresAt time.Time
Method AuthMethod
}
TokenInfo holds session details fetched from the server.
func FetchTokenInfo ¶
FetchTokenInfo queries the server for session details using the given token. For session tokens, calls /api/auth/get-session. For API keys (kh_ prefix), validates via /api/workflows and returns basic info.
Source Files