Documentation
¶
Overview ¶
Package auth resolves SCM credentials per repository owner through pluggable backends, allowing separate accounts for each configured project.
Credentials are looked up by host and owner, cached in memory for the lifetime of the process, and never written to viper or to disk. No configuration field holds a credential directly: settings name an environment variable, an external command, or a gh CLI account from which the credential is read.
Index ¶
Constants ¶
const ( // BackendAuto tries each available source in turn. This is the default. BackendAuto = "auto" // BackendEnv reads the credential from the environment variable named by auth.env. BackendEnv = "env" // BackendGh reads the credential from the gh CLI (GitHub only). BackendGh = "gh" // BackendCommand reads the credential from the stdout of an external command. BackendCommand = "command" // BackendNone makes unauthenticated requests. BackendNone = "none" )
Supported credential backends, selected via the auth.provider setting.
Variables ¶
var Backends = []string{BackendAuto, BackendEnv, BackendGh, BackendCommand, BackendNone}
Backends lists every supported auth.provider value.
var ErrNoCredential = errors.New("no credential found")
ErrNoCredential is returned when no configured backend yields a credential.
Functions ¶
func Reset ¶
func Reset()
Reset clears the in-memory credential cache. It exists for tests and for commands which need to re-resolve credentials after changing configuration.
Types ¶
type Scope ¶
type Scope struct {
// Owner is the project or organization these settings apply to.
Owner string
// Provider names the backend used to resolve the credential.
Provider string
// Env names the environment variable holding the credential. It never holds
// the credential itself.
Env string
// Command is the argv of an external command whose stdout is the credential.
Command []string
// Account optionally selects a specific gh CLI account.
Account string
}
Scope is the set of credential settings which apply to a single owner. Values are merged from the top-level auth settings and any matching auth.owners entry.
func ResolveScope ¶
ResolveScope merges the auth.owners entry for the given owner over the top-level auth settings. An owner entry only overrides the fields it sets.
type Status ¶
type Status struct {
// Owner is the project or organization this status describes.
Owner string
// Provider is the backend which resolved (or failed to resolve) the credential.
Provider string
// Source describes where the credential came from, or would come from.
Source string
// Fingerprint is a truncated SHA-256 digest of the credential. It is empty when
// no credential was resolved or the owner needs none.
Fingerprint string
// Unauthenticated reports whether the owner is deliberately configured without
// a credential via the "none" backend.
Unauthenticated bool
// Err records why resolution failed, if it did.
Err error
}
Status describes the outcome of credential resolution for a single owner. It deliberately carries no credential: the digest is one-way and truncated, so a Status can be rendered without any risk of exposing the underlying secret.
func Describe ¶
Describe resolves the credential for the given host and owner and reports the outcome without exposing the credential itself.
func DescribeAll ¶
DescribeAll reports the credential status for every given owner, preserving the order in which they were supplied.
Source Files