config

Documentation

Index

• Constants
• func APIURL(p *Profile) string
• func Dir() string
• func Lock() (func(), error)
• func Path() string
• func Save(cfg *Config) error
• func Update(fn func(cfg *Config) error) error
• type Config
  • func Load() (*Config, error)
  • func LoadOrEmpty() *Config
  • func (c *Config) ActiveProfile(explicit string) (*Profile, string, error)
  • func (c *Config) ActiveProfileName(explicit string) string
  • func (c *Config) ProfileNames() []string
• type OAuthCredentials
• type Profile
  • func (p *Profile) AuthMethod() string

Constants

const (
	DefaultAPIURL      = "https://api.cubepath.com"
	DefaultProfileName = "default"
)

Functions

func APIURL

func APIURL(p *Profile) string

APIURL returns the base URL to hit for a given profile, honouring CUBE_API_URL.

func Dir

func Dir() string

func Lock

func Lock() (func(), error)

Lock takes an exclusive lock on the config directory, shared by every cubecli process, and returns the function that releases it. Token refreshes run under it: refresh tokens rotate on every use, and presenting an old one revokes the session.

func Path

func Path() string

func Save

func Save(cfg *Config) error

Save writes the config atomically (temp file + rename).

func Update

func Update(fn func(cfg *Config) error) error

Update loads the config, runs fn on it and saves it, all under the config lock.

Types

type Config

type Config struct {
	CurrentProfile string              `json:"current_profile"`
	Profiles       map[string]*Profile `json:"profiles"`
	// OAuthClients maps an authorization server issuer to the client_id this
	// machine registered there, reused by every login.
	OAuthClients map[string]string `json:"oauth_clients,omitempty"`
	// SkillsPrompted records that `cubecli login` already offered to install
	// the agent skills, so it asks only once.
	SkillsPrompted bool `json:"skills_prompted,omitempty"`
	// MCPPrompted records the same for the MCP server.
	MCPPrompted bool `json:"mcp_prompted,omitempty"`
}

func Load

func Load() (*Config, error)

Load reads and parses the config file, migrating the legacy format on the fly. Returns an error if the file is missing or empty; callers that want to fall back to env vars should use ActiveProfile instead.

func LoadOrEmpty

func LoadOrEmpty() *Config

LoadOrEmpty returns the parsed config or an empty one if no file exists yet.

func (*Config) ActiveProfile

func (c *Config) ActiveProfile(explicit string) (*Profile, string, error)

ActiveProfile returns the profile that should serve the current invocation. If CUBE_API_TOKEN is set, it synthesizes an ephemeral profile so env-based auth keeps working even without a config file.

func (*Config) ActiveProfileName

func (c *Config) ActiveProfileName(explicit string) string

ActiveProfileName resolves which profile should be used, in order: explicit name > CUBE_PROFILE env > cfg.CurrentProfile > "default".

func (*Config) ProfileNames

func (c *Config) ProfileNames() []string

type OAuthCredentials

type OAuthCredentials struct {
	Issuer          string    `json:"issuer"`
	TokenEndpoint   string    `json:"token_endpoint"`
	RevokeEndpoint  string    `json:"revocation_endpoint,omitempty"`
	ClientID        string    `json:"client_id"`
	Resource        string    `json:"resource"`
	AccessToken     string    `json:"access_token"`
	RefreshToken    string    `json:"refresh_token"`
	AccessExpiresAt time.Time `json:"access_expires_at"`
	Scopes          []string  `json:"scopes,omitempty"`
	Email           string    `json:"email,omitempty"`
	Organization    string    `json:"organization,omitempty"`
}

OAuthCredentials is the session stored by `cubecli login`.

type Profile

type Profile struct {
	APIToken string            `json:"api_token,omitempty"`
	APIURL   string            `json:"api_url,omitempty"`
	OAuth    *OAuthCredentials `json:"oauth,omitempty"`
}

Profile holds the credentials for one account/organization. Exactly one of APIToken (static token, e.g. for CI) or OAuth (browser login) is set.

func (*Profile) AuthMethod

func (p *Profile) AuthMethod() string

AuthMethod reports how a profile authenticates: "oauth", "token" or "".